A new update rolled out to the battle.net client tonight with a revamp of the Suggested Friends feature, and people are just now realizing that with this feature people can see not just the BattleTag of anyone their friends are friends with, but the real names of anyone with whom you're RealID friends. There is an option to turn this off in your Battle.net privacy settings, but for whatever harebrained reason these are opted-in by default.
To change it:
Log into the b.net client and click on the little guy in the upper right hand corner showing your online friends.
Click the Settings widget in the upper right hand corner of that window and click Privacy Settings.
Uncheck "Suggest me to friends of friends."
You also have the option of disabling RealID here. From what I gather, you'll still be BTag friends with those people, but your real name will be left out of it.
There's a forum thread if you're interested.