Yes, in UK law it is legal for an employer to actively monitor communications of employees using the internet. This is why many employers have AUPs and Social Media Policies stating as such. And also why more astute employer systems are deployed with SSL certificates which allow them to monitor your HTTPS comms. This is fine and provided for in the exceptions of RIPA, Telecoms Regulations and the DPA.

I imagine the distinguishing feature in their case is the Active Access rather than Active Monitoring. Although there was a recent similar case from Romania where the ECHR ruled there was no contravention of Human Rights (privacy), where the employer-initiated interaction with the Yahoo account also implied Active Access. Although the defining part of their case was the employer banned using Personal Comms while at work, and this is how the ECHR ruled there was no contravention as the business was ensuring its 'economic well being' given the rules it had in place. While ECHR cases are not binding, I've failed to find any UK case law addressing the Monitoring vs Access point so it's reasonably to suspect it could be referenced. I don't think Human Rights is the right tree to bark down though given the CMA aspect.

As for using the information gained in their investigation of another employee against you specifically, I foresee an issue. They have breached your right to 'confidential correspondence', privacy, and possibly breached the DPA in 'processing' your information which you likely did not publish publically or using an employer system. Generally the only exception to access Personal Data on systems they do not directly have authorisation for, is the investigation of actual crimes... not initiating disciplinaries. RIPA, TR, etc, only give exceptions for monitoring, not for Active Access. It would be reasonable to assume that as such, the employer has committed a crime in accessing this account and is using data obtained in performing this crime unlawfully against you.

Unfortunately with that said, I don't see a recourse for you, other than using these particular points to challenge the disciplinary. However, if you were to find yourself in an untenable position... the closest useful avenue would be constructive dismissal, but it might be a stretch. That, and, evidence such as your private FBMsg 'opinions' would be admissible in the tribunal regardless of how they were obtained!