Actually, a friend of mine several weeks ago played with an iPad at an Apple Store just before closing, and signed in to her Facebook account. (Obviously, a dumb move.)
The next day we were all bombarded with really obscene messages on Facebook.
Who knows who did it? But it was just prior to closing...I suppose it could have remained signed in to Facebook at store opening the next day and it was another customer...but who knows?
Always restore a phone to factory settings before bringing in for replacement if possible...
On another note, go over to the QVC forums and see how many complaints are on there about people getting refurbed items with all sorts of "presents"...DVDs still in drives...tissues in purses...an eyelash in a compact...