Great question - we're using the xmpp_login permission that Facebook Auth provides to get messaging permission from the user and we have an XMPP server running on Node.js that handles all the messaging.