If you, or any of your friends (even a single one, since defriended).

Facebook App security started out extremely lax, letting you pull all info including pictures about anyone visible to the user of said app.

The app also pulled data about friends of people who used the app, so if someone in your graph used it, you may have been scraped.