This is the basic vulnerability from the large cell phone db scrape that was released? contact to FB matching. Seems pretty bad not to check the problem doesn't still exist elsewhere...

I wonder if OP tried bulk requests see if there is any request limit or other throttling checks at least.