[metalised]

I'm fairly sure the way they managed to claim ownership in the first place was by 'claiming the page for their business', because no business account was associated with the page.

In my case there was no 'business manager' associated with the page because it was a community page. But it's not a stretch of the imagination to imagine there are many 'business' pages out there, which are still managed via a personal account only, and can be 'plucked away' from their owners by a scammer the same way!

I would have thought Facebook would at least have some sort of semi-automated "dispute" process for when someone claims your page at the very least!