People allowing the app to access their contacts presumably. Contacts can contain email addresses as well as phone numbers.
I also know that one of my so-called "friends" posted a group picture with me in it, and labeled the people in the picture. At one point I did a search to see what information was out there about myself, and that picture popped up associated with my name.
I guess that I'm just another casualty of the information age, in spite of my best efforts.
But with ML facial recognition I figure the jig is up.
In general, AI that's hawked at CEO types and police is mostly snake oil, inferior to what you can make yourself if you read hackernews and are willing to dive into Arxiv.
Not sure how much of that has changed since then. But contact data is by far the most valuable mined from phones. Facebook is no exception.
I know it suggested my ex-girlfriend as a connection when I opened my account, five years after we'd last talked.