I think the key thing here is the TA was a HS friend and therefore nothing seems to have gone through her agency (and even if she is independent, she should have at the very least a designated email for business) but was done over FB messenger.
I highly recommend using a TA, but do it officially. All contact should be through their business email and/or phone. And you should be getting statements whenever payments are made showing the current balance due and the date final payment is due. Most agencies seem to set the final payment a few days ahead of the actual final payment date in case there is any issue. But FB messenger is NOT the way to be booking.