These people must have their privacy set to 'Everyone'.
Facebook's Privacy Guide states that such information may be visible to everyone on the internet.
Facebook's Privacy Guide states that such information may be visible to everyone on the internet.
Yep - the way Facebook set it by default for them without them realizing. And then it fails to indicate anywhere in the posting UI that the post is going out to the entire universe unless they explicitly click a lock icon that is an standard internet icon for indicating that your content is already secure.