You are right. It only returns name and id. You can only get the email address of the authorized user. I still understand why Facebook would prevent scraping though. And also I see many exploits of allowing access to your friends email addresses.