Considering what the 3rd party app is (newscloud), it doesn't really surprise me.

If I remember correctly (been a whild since I looked at it), there is a problem with the facebook API that allows any member to post their own information. Instead of setting it up like the members are contributers, it is set up like they are members, so "need" direct access to the database. Even if facebook fixed the problem, I'm sure a lot of developers didn't do it right. You can probably get the same type of results from most apps that allow people to submit their own content on facebook.