For years, Facebook asked some new users for email passwords, then grabbed their contacts without consent (or any way to stop the process).