During the creation of a Facebook account you must provide an email address which becomes your primary email address. A security researcher found a vulnerability in Facebook, yes another one, that reveals the primary address of any account. The flaw can be found in the invitation mechanism and hackers and spammers can exploit this vulnerability to get the primary email address of every account. The process can be easily automated so this is not an issue to someone with basic programming knowledge. I will not post the steps of how someone can get this information as it is already patched by Facebook and they awarded $3500 to the person that found the vulnerability. If you receive an email to your email address that you only used on Facebook then you know why.
Facebook vulnerability reveals the email address of any account