FB's security people likely track and have copies of account/password dumps from site breeches. Sort of like Troy Hunt does with haveibeenpwned.com but for their own internal security measures.