If the attacker doesn't have the key, he will have to bruteforce the full hash and not just 9999 values. Or what is the different use here? The root post was referring to storing hashes and not passwords (better to store HMACs and not hashes).
HMAC means Hash based Message Authentication Code.
HMAC(K,m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m)).
HMAC(key, password) instead of hash(password) or hash(salt+password)