The below does not constitute legal advice, does not form an attorney-client relationship, and should not be relied upon to take or refrain from taking any action.
It is not necessarily unlawful -- under either criminal or civil law -- for one person to access another's Facebook account. There are many situations when such access would be lawful (such as, for example, pursuant to a contract, via an implied license, by a parent accessing his or her minor child's account, via a court order).
Assuming no legal justification, then accessing another's Facebook account would be an invasion of the account-owner's privacy rights. If the one accessing the account then took advantage of that access to post information as if he or she was the account-owner, that conduct would be unlawful as well. Under these circumstances, the account-owner would have one or more civil claims against the person who accessed the account. It may be difficult for the account-owner to prove he or she suffered any damages, however. You need to speak with an attorney in your state.
As for criminal law, our various States have their own laws on the books relating to computer intrusion. You would have to speak to an attorney in your state with experience in internet law to determine if your State has an applicable criminal law.
The following is not legal advice.
Assuming that you are not authorized to use the account, doing so could be a violation of Federal Law, namely 18 U.S.C. § 2701 (the Stored Communications Act) or 18 U.S.C. §1030(a)(2) (the Computer Fraud and Abuse Act). These laws have been utilized to prosecute unauthorized access to a web-based email account.