>These were services that acted as clients for the private messaging so they could send media directly to your friends via FB messages.

So why wasn't the access write-only? If the only purpose for 3rd party access to messages was to send messages, there is no reason they should have been able to read any messages. Seems like a pretty trivial, obvious function - I certainly have keys for send-only access to email accounts to let web apps send things on my behalf with minimal possible privacy exposure.