what's so surprising about this?
you can get list of valid emails and just run them through facebook search and you ll get names and profile URLs, both public information no matter what your security settings are.
nothing special about this
Where do you get a list of 1 million valid emails?
Type "buy email lists" into Google and pick any ad. Even Salesforce appears to be selling 30 million e-mails.
That's what I'm saying...
anywhere, but thats not my point.
the point is, that its the same as getting list of email addresses. and no1 would be surprised if i would publish list of emails but this list is suddenly security issue
You just crawl the web. I am not surprised either by this, I don't consider emails and first/last name as private data.
FB emails are probably a bit "fresher" than ones found by randomly crawling the web.