or they login via twitter then refer the facebook account.. not that I've seen that happen already.
Having 2 or 3 twitter accounts is not a big deal for his site. Creating 10000 vanilla accounts would be. Adding that kind of anti-spam methods is a lot of work and not easy to get right.
IP throtterling. now if they create the accounts on unique IP's then you have somebody who is overly dedicated. It is when the reward is less than the effort to cheat that you have a workable system of protection.
Beyond that there is no golden solution without costly verification process's.