someone has her token, that token used to invite friends to groups.. so maybe he used some autoliker. or viral facebook app or somethingSo I talked to the girl who invited me to the group. She told me that she didnt remember clicking suspicious website or using an application which may cause stealing of access token. But I'm sure she clicked something that caused the script to initialize.