Unless Spotify has some backdoor API with Facebook, it seems like a major oversight in the Facebook API that an (any?) app can re-register a deactivated account and give itself whatever permissions it wants.

Just because Spotify accidentally (or purposefully) took advantage of that hole doesn't mean it's not Facebook at fault here.