It sounds like this is iOS's built-in Facebook integration that was blindly trusting Facebook's data.
anyone else think Apple and Facebook make interesting partners? They're both doing their best to get users into their own domains to the exclusion of all else
In iOS6 any app that wants to access your address book or calendar has to request permission. It's very much like how an app requests permission to send push notifications in iOS5.