Well it's being done through the API, which is presumably OAuth'd under your name, but again, this API is generally used by other sites to interact with your ph

Well it's being done through the API, which is presumably OAuth'd under your name, but again, this API is generally used by other sites to interact with your photos library, and it's very easy for someone to just approve the OAuth permissions for sharing photos, not realizing they are also implicitly sharing their location.