When you come down to it, it really isn't an email service but another way of sending messages. The problem is that people who have their Facebook settings as "Public" rather than "Friends" are likely to be getting spam messages. As Graham Cluley said in the above-referenced Sophos article, "the @facebook.com email addresses are likely to prove attractive targets for spammers hawking goods and malicious links."
