Why did he need to download facebook source code after he found the vulnerability? Why did he need to breach the server at all? Much less 3 servers?!
This here is the root of the problem of why his actions were so wrong.
Granted, he shouldn't have been poking around in the first place, but that action (if limited to that) might be able to be forgiven. Everything else he did after the poking around was very much uncalled for and unprofessional behavior.
It would be one thing if he accidentally stumbled over a possible vulnerability, but that is Not what he did.
Example:
"Hello facebook security team.
I was attempting to reach my server at 123.x.x.x port yyyy, and I accidentally 'typoed' the address and entered 124.x.x.x, which appears to be assigned to your network.
Port yyyy is the defacto standard port for service (blah), which is known to have vulnerabilities in recent versions.
While an open port is hardly conclusive, I wanted you to be aware it was open. If you were unaware of that fact, you may wish to check and make sure there are no further problems.
I happen to run a professional security auditing company, and if you have any interest in our services, please feel free to contact me.
Please note we can NOT perform any detailed analysis without a business contract, and signed agreements of permission from you. You will likely require an NDA from us as well. We can speak on details if you choose to contact us.
"
Going any further than that example, such as verifying the open port has a vulnerable service (say a nesus scan or another such tool), let alone exploiting the vulnerability as proof it exists without permission, is not considered good will.
Downloading data of any type is Never valid evidence, unless your contract specifically states that is your end goal, as specified by the company!
Standard procedure (after having written permission) is touching a zero byte file of a specific name, and making a log of their locations and c/m-times. That way it is easy for the client to both find all such files, and confirm nothing else was modified after that point in time.
True professionals work only under contract, and have a packet logger sitting between their LAN of pen-test systems, and the network connection to the client. FULL logs are turned over to the client, both as proof of what you did, and more important, what you did not do.
There are plenty of companies out there who will hire a security auditor willingly. Nothing good can come of an unsolicited notice like this, nor doing the work for free ahead of time only to get paid in months of jail time.