facebook has been sending these mails out on my behalf. i know because i'm on my own address book.
and my address book was accessed by facebook exactly once, when i first signed up two years ago.
i somehow don't remember agreeing to let them use my contact list, much less invite *all* my contacts. and definitely not two years later.