It is not like the evidence IS his FB profile - he has been recognized, at least by the woman who reported him in. So, even if one takes the pains of "FB is ivading privacy" (to the point people can't be criminals), this instance is not a matter of the evidence being illegal. The most any lawyer could clain would be "the way my client was found was illegal under privacy laws", but once he is found, there is no undoing it. What could possibly be done in a case like this? Subject the guy to some "witness protection program", get him a new secret ID and life, so that he would have to be searched again for theft?