They aren't confirming anything. People are looking at wallposts and thinking/remembering they are private messages, but everyone that has tried to verify using email notifications has found only wallposts. Until someone shows that a verifiable private message showed up publicly, than there's no reason to continue spreading this. If it's a problem, it can easily be confirmed. Even Techcrunch, who criticised Facebook's response have now backpedaled.