Notorious spam king Sanford Wallace is facing federal fraud charges for allegedly breaking into Facebook accounts and sending 27 million spam messages in 2008 and 2009.

Wallace, 43, allegedly used a phishing attack to steal usernames and passwords from victims, and then used the stolen credentials to post spam to victims walls, the US Department of Justice said.

Wallace allegedly made money from the scam by driving web traffic to affiliate marketing companies, who pay their members by the number of clicks they can deliver to websites.

Wallace gained fame as one of spam's most vocal defenders back in the 1990s and he has faced numerous civil actions over his activities, including lawsuits from MySpace and the US Federal Trade Commission. However this is the first time he's facing criminal charges.

Wallace has also been sued by Facebook, which won a $711 million (£436 million) civil judgement against him. As part of that judgement, he was banned from Facebook, and the criminal indictment accuses Wallace of contempt of court for allegedly logging onto the social network during an April 2009 flight from Las Vegas to New York.

Wallace also allegedly set up a Facebook profile in January of this year, under the user name David Sinful-Saturdays Fredericks.

"We applaud the efforts of the US Attorney's Office and the FBI to bring spammers to justice," Facebook said. "Now Wallace also faces serious jail time for this illegal conduct. We will continue to pursue and support both civil and criminal consequences for spammers or others who attempt to harm Facebook or the people who use our service."

Wallace could get more than 16 years in prison, if convicted.