The social network was grabbing email contacts of some new users for almost three years, it says.