It's true I fear...the big social networks (Facebook, Twitter and linkedin) all allow both name and profile pic as public even when you make your profile private.

Spidering this data would build an amazing database for facial recognition. This is actually a very well developed technology...if you don't believe this check out the Google Picasa app..it's rather concerningly good at facial recognition.