We can't know for sure since it's not something they publish (as far as I could find).
Here are my guesses: (Which are mostly based on my experience with Facebook)
- An invitation was sent to your email address (as you said).
- Your friends searched your name on Facebook in the past.
- Or searched your email address.
- Or your phone number.
- By your location - GPS or estimated by IP address or any other method.
- By your contacts (any data that can be found in your address book):
- Phone numbers
- People you've talked with on SMS.
- Your Instagram account - any connection to other people - follower, following etc.
- Your WhatsApp chats:
- Private chats - also if someone who's not in your contacts just sent you a message, and you haven't even replied.
- Your friends data on their accounts:
- You as a contact on their phone (even if not mutual) - with all the data they saved on you.
- You as someone they've sent an email to.
I believe there are a lot more, but basically - every piece of data they can collect from you or from people you may know - they collect and use - from location, contact, circles etc. They are fantastic at connecting all this information to get useful insights.
Note: Some of the options are more relevant from mobile and others from desktop.