The App company is piggybacking on Facebook's spam prevention algorithms instead of implementing or purchasing their own.

While that is correct, and I would also personally prefer that we continued to use e-mail based authentication for other reasons, Facebook does have measures in place now that make it more difficult to create loads of fake accounts.

Specifically, they now require a phone number to create an account. Getting a new phone number is more difficult than creating an e-mail address, so this will prevent at least some of the fakes.

Years ago, once in a blue moon having a Facebook account meant you also had a @facebook.com e-mail address [1]

[1] https://www.huffingtonpost.com/2014/02/25/facebook-email_n_4...