Facebook security hole to blame for spam attack