There is a possibility that if you have multiple Facebook accounts and use the same browser for each, a cookie could be used to link the two. Just because two people use the same computer and the same browser to login to Facebook does not mean they are friends. You might be using a public terminal.
Facebook could match a specific browser session with user visits to other sites that have Facebook features. Your digital fingerprint could be determined through your browsing habits. You don't need to be logged in for that. That would be pretty insidious of Facebook. I'm not a fan of 3rd party JS scripts in that respect.
I've seen friend suggestions that are linked to my email account that I've signed up with. I think this is an email address book leak. Perhaps it's possible to discover someone's work contacts say by just signing up with that someones email address (say a work address). I'm not sure if the email needs to be verified before this information is leaked.
I think it's actually a rather sophisticated algorithm. For example, if you own multiple Facebook accounts, it uses what is likely a combination of IP history and persistent cookies to suggest friends no matter what account you are logged into, or what computer you're accessing it from.
My guess is that Security brought this up with management, management consulted business analysts, analysts said fixing this will cripple the accuracy of "Suggest a Friend", and Security has no other recourse. So it stays.