Facebook allegedly buys transaction data (you know like banks and payment processors etc. sell). So they have a browser fingerprint for you via cookies (you know that like and share button on every page on the internet) or just plain JS fingerprinting.

Matching all that data to the real information you just ran through paypal or other merchant (some merchants sell this data directly) is something an intern can do on their first day.

I thought they denied maintaining shadow profiles though? There seems to be some people at FB who actually care about getting this stuff right and doing the right thing but economic forces at this point appear to be pushing most of the company in a very different direction.