yes, he must have your connected mail so to try different passwords.
Of course if he saw some posts of you as fb user, could guess your mail and try a password
for example boris.johnson@gmail.com password ... brexit2019
I suggest you to link your teams also in a google account but not with the mail you are using for facebook.