There is a relatively simple explanation - but of course, it doesn't have to be true. It is just a viable hypothesis.
- You give your contact data to your co-worker. Including Facebook profile, or the e-mail address associated with it.
- Your co-worker types your contact data into a smart contact-managing application, possibly of Microsoft origin. He doesn't manually add a picture of you, so it associates your record with a picture from your Facebook profile.
- You give your co-worker your Live Messenger account. He types it into his contact management application and associates it with your record.
- Live Messenger is aware of the contact management application. It synchronizes with it in the background.
- a. Your co-worker's Live Messenger install uses the picture it found in your contact data when he has a chat with you open (basically acceptable, although a feature I'd turn off if I was using Messenger and knew it existed)
At least steps 1 and 2 are not that uncommon - this is exactly what happens on my phone, the contact management app uses my contacts' Skype pictures, even if I have never initiated a Skype call or chat to them over the phone. 3 is also very believable. 4 and 5 are pure speculation, but in line with what I have come to expect from Microsoft products (like tighter-than-necessary integration between mildly related products, plus doing a lot of things behind the user's back without being asked to).