It looks like Facebook didn't strip out the copyright since it says "Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer."
It is also clearly a file that is supposed to be used outside of Oracle, the following comment states (at http://www.java.com/js/deployJava.txt): "You are encouraged to link directly to the live copies."
The real question is why it appears twice after being packaged.
You can create an account, add all of your emails, but then limit their visibility to 'Only Me'. That way people can't impersonate you, and you don't need to reveal all of your emails to everyone.
I have found another security hole: When viewing a photo, you can take a screenshot of it and upload it to anywhere else on the internet, where any arbitrary person can see it.