Indeed, a similar "secure" crush confession on an MIT facebook group was exploited in this way, by brute forcing every name in the student directory.