You have to mark packets and use a queue. The queue can limit the aggregate speed of these marked packets. The queue won’t concern itself with the number of users, rather it’s just 10mbps for all facebook connections.
To mark the packets, you’ll have to use a firewall mangle rule and address list. Facebook IPs shall go in the address list. Packets in and out ether1-gateway to or from IPs in the address list should be given a mark so they’ll go through the facebook queue.
Because facebook may change it’s IPs, you’d also need a script to maintain the address-list. The script would have to resolve the various facebook hostnames and update the address list. The daunting part will be finding IPs to all facebooks subdomains for content delivery. And these subdomains can change at Facebook’s discretion. The below link is a big list of subdomains facebook uses. This is NOT an official list from facebook. http://vkian.com/facebook/list-of-subdomains-of-facebook-com-interesting-things-behind-facebook.html