Facebook isn't special; it's just a subset of the Internet. If the people at your college had had, say, a mailing list instead, and someone had sent that picture to it (thereby putting a separate, cacheable copy in every person's inbox), would you reason similarly that "he should have had control over this kind of thing"? Just because it's one website, not millions, doesn't mean that anything put onto it won't be leaked back out by bullies, trolls, rumor-mongers or busybodies. There's no such thing as privacy in a network where even a single person is less than 100% trustworthy, no matter the medium.