That was my first thought too. My guess would be a shortened URL that redirected to a private server, which then redirected to some Facebook contact form. Facebook message times could then be roughly correlated with IPs harvested from logs from the private server.