If the user previously had a public profile and later made it private, some old profile pictures might be archived. Try web.archive.org with their profile URL. Success is rare, but it’s harmless.
The website asks you to "log in with Facebook to verify you are not a bot." When you do, the malicious script steals your session cookie or access token. The scammers then take over YOUR account, spamming your friends or locking you out.
Some users occasionally make certain posts public. Check their profile occasionally for any visible updates.