The trouble is that Facebook doesn't know every email providers rules and which email addresses the email provider considers equivalent. So for Facebook, [email protected] and [email protected] are two separate addresses (and indeed [email protected] and [email protected] probably really are two separate addresses probably controlled by two different people).

You're right that if Facebook required the email to be verified (by sending an email to it) before it could be used with Facebook then two different people wouldn't be able to have two separate Facebook accounts with one of them having an email address controlled by someone else. However, Facebook, in order to "reduce friction" and "reduce time to first value" is happy for you to use an unverified email address and they're happy to send a variety of emails to that address (including lots of emails telling you to finally verify that address).