This happened to at least two of my friends. Someone takes out an account pretending to be them. The person they're spoofing likely hasn't set privacy settings so only friends can see their friends, or gets access some other way. They then contact those friends and request friendship.

If I'm one of the people they want to friend, I notice someone who's already my friend wants to be my friend, and post a message on the real person's wall letting them AND their friends know. Then I report the fake friend and block them. The person who's targeted also needs to tell Facebook in order to get the fake account removed, and it doesn't hurt if other of their friends report them.