Photon is messing up external image urls

Photon will indeed be applied to all image URLs. Only URLs including specific parameters will be excluded from Photon.

In your case, Photon returns a broken image because Facebook blocks direct access to the image:

curl -svv 'https://scontent.xx.fbcdn.net/v/t1.0-1/p50x50/531073_287582807985582_653744962_n.jpg'
*   Trying 31.13.93.7...
* Connected to scontent.xx.fbcdn.net (31.13.93.7) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* Server certificate: *.facebook.com
* Server certificate: DigiCert SHA2 High Assurance Server CA
* Server certificate: DigiCert High Assurance EV Root CA
> GET /v/t1.0-1/p50x50/531073_287582807985582_653744962_n.jpg HTTP/1.1
> Host: scontent.xx.fbcdn.net
> User-Agent: curl/7.43.0
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< Access-Control-Allow-Origin: *
< Content-Type: text/plain
< Server: proxygen
< Date: Thu, 30 Jun 2016 14:20:21 GMT
< Connection: keep-alive
< Content-Length: 0
<
* Connection #0 to host scontent.xx.fbcdn.net left intact

To solve this issue, you could use the jetpack_photon_skip_image to exclude specific images from Photon, like for example image URLs using a specific Facebook domain:
https://developer.jetpack.com/hooks/jetpack_photon_skip_image/

That should help!