Exactly. This isn't a new or even particularly cunning trick, and -- contrary to lots of comments in this thread -- it won't die off if people leave Facebook, because it's not something you have any control over. If someone else has the address, they can give it out, and if it's the only address they have for you and they're using something which scans an address book or lets you look up potential contacts by email address, well, that's that.

The only way to avoid this is not to have an email address in the first place.