It's possible that the person being recommended has lax settings.

Connections are a two way street. Facebook can assume that if he has connections to you, then you may have a connection to them.

Nothing nefarious is necessary.