In some cases clicking on a link logged in to that account without the need for a password, the BBC reports.
All the links exposed the email addresses of Facebook users, the report said.
Facebook security engineer Matt Jones said the links were typically only sent to the email addresses of account holders. Links sent in this way can only be clicked once.
"For a search engine to come across these links, the content of the emails would need to have been posted online," he said.
Jones suspected this is what happened as many of the email addresses exposed were for throwaway mail sites or for services that did a bad job of protecting archived messages.