Yes, the app developer is definitely at fault. The question at hand is whether Facebook could/should have done something/more to avoid this kind of situation.

Yes, the app developer is definitely at fault. The question at hand is whether Facebook could/should have done something/more to avoid this kind of situation. I do not have a definite answer to this question, but one could imagine both technical and legal means that can be used to avoid such abuse of data. The other question at hand is whether Facebook should be allowed to hold this kind of power. Again, I do not have a definite answer and if the answer is "no", I have no idea how this could be implemented.