What they do, is take the friends' list from their individual members, and 'force-add' those friends.
If you want to prevent this from happening, set your security and your updates to "Friends Only" instead of "Friends of Friends".
Now that I think of that, not worried about anyone adding me to a group (my friends know better).
________________________________________________________________