All she said was "Digital etiquette: always ask permission before posting a friend's photo publicly. It's not about privacy settings, it's about human decency." - is that especially unreasonable?
If she posts it to a social network, isn't the expectation it will be viewed by others?
And if she's not happy with who all can view it (and it being shared "outside the group"), now she knows potentially how the average bookface user feels.
If she doesn't like it, maybe she shouldn't use the service. She agreed to the same terms as every other user. Or maybe she should put her brother in a headlock until they devise a way to keep this from happening again (one that would benefit ALL bookface users).