Facebook may have broken the law by harvesting 1.5 million users’ email contacts, experts say