"anyone with access to the server such as staff or government officials can add new members to a private group without permission of its admin members"
Wow, I don't think I've found myself is such load disagreement with James. I think the FB study was research. I think that the OKCupid case is much less clear.
I wrote up a long email about that I sent to Andrés Monroy. I should maybe publish that as a blog post.