I was somewhat surprised that they were able to get my profile picture from facebook, as all my settings on facebook were set to be very restrictive (at least last time I checked).
Of course, Facebook seems to ease their privacy settings to the more lax version over time.