We know that Facebook maintains a social graph of non-users. Worse, anyone can access targeted bits of it for free. How?Facebook allows any new account to use Facebook for 24 hours without email verification. As a consequence, anyone can register with your email address (provided you don't use that address for Facebook), and use Facebook for 24h. They will be getting various "friend" suggestions picked from people having you (with that email address) in their address book.No big deal? Story time. My name is John Smith. A lonely person also named John Smith, from a different country, decides to seek love on Facebook. He creates an account and, having no email, randomly puts johnsmith@gmail.com in the field. Bad luck for me, I am johnsmith@gmail.com, and I do not use that email for Facebook: I use it for work. John decides to befriend all female "people-you-may-know" suggestions. I suppose those start with people who have emailed me at some point. It starts with my boss's wife (my boss and I had had a family barbecue previously) and the graph quickly expands from there on to people I had no direct contact with. The first few new "friends" have no reason to refuse the request, since it is attached to my name and they don't have me on Facebook already (I don't add colleagues on Facebook). The next "friends" see people they trust as "friends-in-common". Ten hours later, my boss texts me that something fishy is going on. I check that email address, see the Facebook verification email, reset the password, log in, and discover the many fortunately-tame but still-embarrassing attempts of poor John Smith.I believe this was not an impersonation attempt, but one does not need much imagination to see the many funny and not-so-funny application of this "feature". Pick a time when the target is in a different timezone (hence won't get a chance to see the verification email immediately) for added fun. Then, enjoy Facebook's creepy social graph data for up to 24h.