Summary: Accessing data is almost certainly OK as the laptop owner controls access and the thief has no expectation of privacy, but actively logging into someone else's Facebook account is questionable at best.
This answer does not consider any state laws that may affect the situation.
Applicable legislation
From a Fourth Amendment perspective, a thief has no expectation of privacy on a stolen laptop (cases cited in the link seem to extend this to all stolen property). While the Fourth Amendment is a protection against government intrusion and doesn't speak directly to individuals invading other individuals' privacy, I think it's a good baseline.
There turns out to be little federal legislation on this topic, as most is either industry specific (eg. parts of HIPAA), or is legislation on what the federal government itself can or can't do with private information (eg. Privacy Act of 1974). The most relevant legislation I could find on the issue is the Computer Fraud and Abuse Act, which is codified in 18 U.S. Code § 1030.
Especially applicable to your question is subsection (a)(2)(C), which makes it an offence for whomever:
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—(A) [...] (B) [...] or (C) information from any protected computer;
The definition of "protected computer" is located in (e)(2) and has been interpreted to include essentially any internet-connected computer (which is the case here, given the remote login).
Accessing the information
Your 1st and 3rd questions boil down to whether accessing/obtaining the information "exceeds authorized access." Somewhat related is the Seventh Circuit Court of Appeals case International Airport Centers, L.L.C. v. Citrin [wiki, full text]. In it, an employee on a company computer deleted information after leaving the company. It was found that he was not authorized to do so.
However, I don't personally think this case actually applies to the scenario. The laptop owner can make a strong argument that as the owner, he can ultimately authorize access to the computer and its contents. Also, with the knowledge that a thief has no expectation of privacy on a stolen computer, it can also be argued that the thief implicitly authorized access by placing the data there or making it available for remote login users to view it.
Additionally, there's a circuit split on what "authorized" means. The Ninth Circuit Court of Appeals has held in LVRC Holdings LLC v. Brekka and United States v. Nosal that restrictions of access (eg. not deleting company files) is not relevant to authorization, it is simply whether use of the computer itself is authorized. Following Ninth Circuit precedent, there's almost zero doubt that the laptop owner can legally access the thief's data as the owner controls authorization to access the computer.
Logging into the thief's account
As I explained above, I believe passively viewing what the thief is doing on their Facebook page is legal. However, obtaining credentials or session tokens and actively logging into the account to find information is different (it's not clear to me whether this is what you meant in your question, but I thought it would be useful to at least bring up this point). Accessing/obtaining data may itself be legal, but the method by which it is accessed/obtained and what is done with that information might not be legal.
In my brief research on this aspect, it is unclear if there would be any civil remedies available if there is no effective damage done (beyond violation of Facebook's terms of service). However, possible criminal offences include unauthorized access to a computer (Facebook's server, via the potentially illegal login) and circumventing technological barriers (by using someone else's credentials). See this EFF article for a little more info.
