> Most likely what happened is that someone entered their own number in connection to their own account, then they got a new number and never bothered updating Facebook, then the number got recycled and assigned to Duguid so he got the alert.

I've had this happen to me and really wish phone companies would wait at least 90 days before putting a disconnected number back in service. The worst part of it is I was given the option to "disable" SMS. But it turns out that doesn't actually prevent shortcode messages from going through.