Maybe it relies on a cookie or something, and it only shows that to you because you've been logged in before.
That does seem to be the case. I just tested it on two browsers, one of which I don't use with Facebook.
On the browser that I don't use with Facebook, the "Please enter your password" screen did not include a name or picture.
On the browser that I do use with Facebook, and had just logged out seconds before, my name and photo did appear. However, if I entered someone else's address, the name and photo did not appear. Just for kicks, I tried two email addresses, one of which I know does have an account and one of which I know doesn't. Facebook *did* tell me which one was not associated with an account.
A spammer isn't going to have your cookies, so they won't get your name and photo. But they can confirm whether you have a Facebook account or not.