I am pretty careful with the privacy controls and none of my stuff is public. I suspect that what happened is that when one of my friends commented on the picture it showed up on their personal iteration and was subject to whatever privacy settings they were using.