Want to stop the thief from using they have the passcode



He will have to gain control of the account before being able to setup the two factor authentication. But it is recommended for ALL FB accounts.
 

That's right. Then Try the option of "Forgot Your Password" and if you are lucky, you will be able to recover your account and also change your password!
After that, as Kanewolf said 2-factor is a must!