"If a user wants to invite a friend who has not subscribed to our site, we create a download link and pre-fill the Facebook message (in our own interface), which the user can edit / configure and click" Submit ", or copy and send through other means (email, chat ...).
We do not send Facebook messages, and messages are not from us, they are users.
If a user invites a friend who has registered on our site (using the "Hook 'em up" button), who sends a notification to our server that the user is connected, and we send this friend an email that such user has connected them. We can do this because when users register on our website, they connect via Facebook and authorize our application to send them email.
We spent a lot of time to ensure that the system does not spam (there are no automatic messages for feeds, no automatic emails, etc.), where people who want them are invited, or users must take an explicit action to tell their friends about this. "
http://www.quora.com/What-Facebook-permission-enables-an-app-to-send-user-to-user-messages?redirected_qid=97754