I have a Facebook account with zero friends on it. I used it to "own" an API key for an app I built for a freelance client.
The "People You May Know" screen on that Facebook account has plenty of people I do in fact know.
I imagine through people uploading their address books and then Facebook mining shared connections, they inferred a bunch of my network without me doing anything at all.
Facebook has your pictures when your friends that are on Facebook post pictures of you.
And even if you are not on Facebook,i'm pretty sure facebook has a "shadow account" system to track people even if they dont signup.