I just asked my first question on Stack Overflow. In that process I typed in my e-mail and a name. All well and good, because I figured it would be nice to be able to log in later, I decided to register using my Facebook account. So, I clicked on the Facebook button, and then agreed to let this site access my public data. All was fine with that, too.
Except that I was never asked to actually confirm that I am the owner of that Facebook account. I was never asked to type in my password, Facebook has yet to send me an e-mail telling me that I've logged in from a different site/client like it usually does, and now I can apparently log in here by simply clicking the "log in" link. No password was ever asked for, so I'm left concluding that anyone who knows my e-mail could have signed me up, and could log in for me and pretend to be me.
What is going on?