Definitely unsettling but this has been a part of Facebook you could hack since they opened up those features last f8. I think the Facebook team does a pretty good job following up on spam reports and shutting down pages/developers that abuse their system. What I usually do to protect myself as a user is connect to Facebook in one browser when I want to use Facebook features and use another browser for most other web browsing.