Facebook isn't on school property so I fail to see how in loco parentis would work or be held up in this situation. Sure, the issue is causing problems for the school community but it is off-site, where the principal has no authority.
I am not saying what the children did was right, they have done something that could negatively impact the lives of a teacher and his family, personally and professionally. They need to be held accountable and given consequences. The right thing would have been for the administration to notify the parent and get their consent...better yet, get the parents to come in and watch as the child logged in to her facebook account. Better accountability and openness that way, makes it easy to avoid the children and parents bringing suit for invasion of privacy (just wait, it will happen).