Pretty sure this is based on one of those "login with Facebook" oAuth apps where your just using Facebook as the IDP. They were probably using the token to look

Pretty sure this is based on one of those "login with Facebook" oAuth apps where your just using Facebook as the IDP. They were probably using the token to lookup the email address (via 'profile' scope) but not validating that the token originated from their connected app. Also, this is why the "client secret" needs to be kept secret (so a hacker can't trick users to login via your connected app)