Of course it was a bug. It seems clear to me they were experimenting with some texting functionality where Path would notify users of things, it made it to production with bugs, and some subset of users got this terrible behaviour.

Never ascribe to malice that which is adequately explained by incompetence.

Oh, I can easily see possible scenarios. For example: have a functionality when you add a contact to the list of contacts, send her a message welcoming her, after asking the user if it's OK. Reuse the same code in the part of the application where you initialize the database from existing contacts. Put wrong defaults there so that the code does not ask "send welcome message?" (because that'd be stupid - of course you don't want to ask somebody 200 times for each of the entries in initial import) but still sends one. Boom! - initial import causes 200 welcome messages to be sent. Happens more than you'd like. Something like that happened to me too, in different form and was caught in testing, nowhere near production, but still.