The man responsible for millions of spam e-mails back in the 1990s and for spamming Facebook users between 2008 and 2009 now faces up to 40 years in prison and a hefty fine.

43-year-old Sanford “Spam King” Wallace was reportedly indicted by a federal grand jury in San Jose, California for hacking into 500,000 Facebook accounts and sending around 27 million messages between November 2008 and March 2009. The charges were originally made back on July 6, but weren’t made public until he surrendered himself to FBI agents in Las Vegas on Thursday.

The U.S. Department of Justice alleges that Wallace used a phishing attack to steal the usernames and passwords from Facebook users, and then used that information to post spam on victims’ walls. He supposedly made money by driving traffic to affiliate marketing companies who typically pay members for every click-through.

In March 2009, U.S. District Court Judge Jeremy Fogel banned Wallace from accessing Facebook as precursor to the $711 million civil judgment against him in October 2009 for violating the Can-Spam Act. But the current indictment accuses him of contempt of court by logging onto the social website just a month later while traveling via Virgin Airlines from Las Vegas to New York. Wallace supposedly set up a fake Facebook account just this past January using the alias “David Sinful-Saturdays Fredericks.”

“We applaud the efforts of the U.S. Attorney’s Office and the FBI to bring spammers to justice,” Facebook said in an e-mailed statement. “Now Wallace also faces serious jail time for this illegal conduct. We will continue to pursue and support both civil and criminal consequences for spammers and others who attempt to harm Facebook or the people who use our service.”

Wallace is charged with six counts of electronic mail fraud, three counts of intentional damage to a protected computer and two counts of criminal contempt. He could get 18 to 40 years in prison and fines of more than $2 million if convicted.

The notorious Spam King, who earned his name (among others) by sending around 30 million junk e-mails per day via CyberPromotions in the 1990s, posted a $100,000 bond after a court appearance on Thursday. He’s not scheduled to appear in court again until August 22 at the U.S. District Court for the Northern District of California in San Jose, California.