On the one hand, I would love the idea of the companies running such services to be incapable of accessing my data. (No, I am not concerned that this would make clear the tenuous nature of their business model.) On the other hand, I've BUILT such services. And I know users. There are a great many users out there which practice the most aggressive and astonishing levels of stupidity when it comes to their own life. I mean, it's breathtaking. It can tempt some people into active pursuit of genocide, simply to erase the shame of sharing a species with such people.

But... if you are going to build a service used by the public, you really have to face the fact that these ARE the people you wanted to be useful to in the first place. And with that, you had better be able to log in as them without asking anything more than just their name. Anything else is simply far too high of a cognitive load to place on them.

This guy gave consent to have his account logged into. Almost every service can do this. Logins are almost certainly audited. There is literally nothing wrong with this.

I can also confirm that this is extremely common and basically standard practice. I frequently emulate my users when doing tech support. Even if this wasn't the case, unless everything in the database were encrypted per user, I could just query for their data.

I assume this is the case for virtually any site. User emulation should be logged and audited for abuses.

I've heard this from FB employees before. Usage is logged against the employee record for audit purposes and can only be done from within their offices.

I can't remember if I'm thinking of FB or another service, but I seem to recall there even being multiple levels of impersonation, so employees masquerading as users for debugging purposes have to explicitly request write access or messages access, but I'm not 100% on that.