I'm glad to see a story like this getting some press as I've suspected that I've been dealing with something very similar for years now. Every so often I get an email from Facebook or some other service asking me to confirm a sign up I never made and under a different name, and then afterwards (where it gets strange) I get an email thanking me for confirming. Gmail says no other IPs have logged into my account and there's nothing in my sent folder related to it. I've changed passwords and it still happens. It's almost as if I share an email address with someone but they have a different "account".
I really doubt that, as it doesn't seem like you can put in multiple email addresses when you are first signing up for Facebook (http://puu.sh/2IP5J.png). I also don't imagine Facebook continues to email the unverified email addresses after a user has changed their address to pass the verification.
