If you, or any of your friends (even a single one, since defriended).

Facebook App security started out extremely lax, letting you pull all info including pictures about anyone visible to the user of said app.