I don't know if it's still the case but you used to be able to use the API to get hashed copies of your friends email addresses (so if a service could rehash th

I don't know if it's still the case but you used to be able to use the API to get hashed copies of your friends email addresses (so if a service could rehash the emails of their own users and hook up the users if they're friends on Facebook). Obviously Google probably have the largest database of email addresses in the world so they probably could just hash them all and figure out who your friends are.