I had reported this to FB security last year when I found it was trivial to find partially masked email ids & phone numbers of anyone behind my Uni's gateway.

I was informed that this was a design decision since previously used IPs are more trustworthy than any new IP. I considered this a design flaw and reported since large institutions are typically behind a NAT and they become susceptible to targeted attacks.