I work for a web dev firm, and one of the features a client wants is a facebook-style "invite your friends by giving us your e-mail and password" feature. I'm trying to think of a nice way of convincing the client that the feature they want is really a psychological bug that's going to cause long-term problems for, well, everyone on the internet.

Why not use bbauth? I know Yahoo and Google support it. That way you can grab their email contacts without requiring them to give you their email/password. It just sends them to the email provider to login, then back to your site with the api token to access their address book.

Still spams a buncha folks tho'.