A Facebook hack could have been exploited to retrieve the private email address of any user with a serious impact on the privacy. The issue resides in the user-generated Facebook Groups feature that allows any member to create an affinity group. The hack was discovered by the hacker Tommy DeVoss who awarded with $5,000 under the Facebook Bug bounty program. Even when users decide to keep their email address private he was able to discover it even when they chose to keep it private. The expert discovered the problem when he canceled pending invitations.”]
Source: https://securityaffairs.co/wordpress/54683/hacking/facebook-hack-email.html