Facebook relied on user generated "abuse reports" as leads for identity investigation. Meaning, you can report a suspicious account and it will be review by FB team (I`m guessing we are talking about log checks, "believable" friend pool and etc)
They got no automatic policy for account identification besides the following:
Feature overuse: Simply Checking the rate of usage for features (i.e. Too many messages/reoccurring content)
Unwanted contact: High "deny friendship" rates/repeat "friendship request" are deemed suspicious.
I actually think they got the right idea here, as behavior-based challenges are probably the best way to find fake FB users.
There are maybe few other things you can do (having a a "suspicious contact pool" signature for example and some Bot challenges like JS/Header and others) but, for me, the main issue here is their Enforcing Policy.
Currently, you have to work pretty hard to get banned from FB, and in the end - with all of their cash flow problems - a large user base is still Facebook's main claim-2-fame and I don`t see them messing with it any time soon.
As for the numbers, I`m assuming they've just based on an avg. or previous fake/real user statistics.