Facebook removes two bits of entropy on login: it tries the entire passphrase with case reversed and just the first letter with case reversed. There's also some fanciness with username correction if you have old cookies.