[Demoralise]

10,000 passwords against an account without getting blocked? I'd assume the IP would be blocked and that even with proxy switching the proxies would eventually run out

[Infamia]

It's either finding an exploit in the Facebook ratelimit which allows you to bypass it or simply generating proxies as you run out. Eventually, ratelimits expire and you can reuse proxies, finding the equilibrium between a good amount of proxies and a check-time of 10k accounts which allows the first proxy in queue to have the ratelimit expired; and thus reuse is plausible.
However, technically, you need to account for the fact that a check may take less than a second; therefore the first proxy might have been unratelimited but the second proxy is 1/n'th of a second from expiration where n > 1; and so that fails, so accounting for that small excess time is also crucial.