Now that outlook.com and other MS email services sync their users' contacts to the entire Facebook Profile database by default, and there are phone apps which sync everything to everything, this is a potentially vast problem re: online identity, which goes way beyond simply receiving emails you didn't ask for.
For any email account owner whose address has been abused in this way, it means that a totally false Profile will be linked to his/her email address on any service or network where contacts are synced to Facebook.
Facebook could kill this at a stroke by enforcing email address verification. They choose not to. One has to ask why?