This is the only way the number could've slipped into Facebook servers. Still, sending fake friend request SMSes to the user when they don't even have an fb account is totally unethical.