we just became aware of an issue which existed between launch and today where, if you edited a private page's profile while it had one or more follow requests pending, the requests would be auto-accepted. the bug has now been fixed, and we added automated tests to make sure it doesn't happen again. if you edit a private page, you should go through its followers list and softblock anyone you don't expect to see there.
our sincerest apologies for letting this happen.
technical details
this stemmed from an overlooked check on code in the profile editor which was intended to only execute if you were changing a page's privacy setting from private to public, but actually executed any time you hit "save changes" on the page's profile. we had automated tests to ensure that the private->public case was working correctly, but in an oversight, had not written a test for the case where the privacy flag didn't change because we expected that check to be handled somewhere else, which it wasn't.