Meta fixed a flaw that let hackers send password reset emails to users, but it says no accounts were compromised. Here's what you need to know.