I tried emailing Facebook regarding this issue, they never replied.

The problem is, if your current profile picture is set to public (which is the default when you update your picture), then anyone can go through your profile pictures album.

Way around it is to set your current profile picture to friends only.