I run the company and posted a photo on the company page that was also my cover photo on my personal FB. DS was in the photo but not recognisable (basically his silhouette from behind). She has said that I sent her this same photo in my last contact (I did not, I'm sure of it) and suspect she has found me on FB and recognised the photo from there.
This would worry me enormously. It seems, from what you are saying, that BM has been using the photos you've sent and your social media to track you down. While that is understandable, it is still a violation of the contact agreement and your privacy.
Did she tell you she knew or come and find you in work?
BM is very mobile, also very stable and we have a good relationship.
it feels like once that door opens I cant shut it.
Obviously all BPs are different. Some will absolutely be people who might be a positive part of your child's life, but most will not. You will have some information about what factors led to the adoption. You need to be really hard headed in assessing the risks here: you don't really know BM; you don't have any control over what she shares with other BF. You absolutely can't shut that door easily if there is a problem.
I think you should take this really, really slowly. I would be very reluctant to do something like this until my child was older and I was certain that BM was very trustworthy with regards to boundaries.
I would not be making any decisions in a rush. You have years. In the meantime, talk to your SW and lock down your social media more.
My only experience of direct contact has been from FC and adopter friends and their experiences have been very negative. Personally I would have hated my BPs having this amount of involvement with my life, growing up. It would have felt like an invasion of privacy and like the choice was being removed from me (though it's a choice I would freely make now).
Forgive my doom mongering- I think you need to hear the cautionary argument. As a PP says, there is lots of evidence that it can be positive, when it's the right situation. Even if you decide no for now, I think keeping up good contact, on your terms, is great.
Ultimately, as the parents you just have to do what you think is right. Keep in mind that your only consideration is your sons's needs. BM's desires are not your responsibility.