Maybe I'm missing something, but generally when doing any type of Facebook/social integration type work, I'm not using my personal account, but rather one dedicated to that purpose (i.e. the client's). How in the world would Facebook know (big brother, tin foil hats, etc. etc.) if this guy is running API calls and send in their secret police? It seems incredibly unlikely to me that, by working through a client (or even a fake profile) and taking part in the thousands++ API calls that occur daily, that there would be any issue here.