[zupa]

As of the FB app on my iPhone, when I wanted to connect it with my phones data (to get extra phone numbers of my friends, and see their profile pics), I was asked to agree that the app can upload the data to FB and let them use it whatever way they want to. (Read: all the phone numbers in my phone, not in the FB app.) That really blew my mind. I didn't agree, but if 500 people have your phone number in their phones, the chance that none of them agrees is zero.

[rish404]

This is the only way the number could've slipped into Facebook servers. Still, sending fake friend request SMSes to the user when they don't even have an fb account is totally unethical.