I don't know how the Facebook end of the targeting worked, but having your friend's name and email address on any number of probably-even-freely-available lists

I don't know how the Facebook end of the targeting worked, but having your friend's name and email address on any number of probably-even-freely-available lists seems highly probable, no need to autogenerate them