Everyone in the contact list didn't provide consent. Facebook better understands the privacy implications here more than individual users so I don't see anything wrong with placing most of the blame on Facebook.