Facebook know how many requests they've responded to. If there is any dishonesty here, it's coming from Facebook. They might have been told to give false numbers, but they've got the correct numbers.

There's the shared-private-keys argument, by which they wouldn't actually know how many requests were made. I haven't been followed very closely so I don't know if private keys thing was specifically denied - was it?

As far as I know, they deny any sort of blanket availability of data - so a shared private key would seem to be denied under that guise. I think claiming a number as they have, and a number of affected users, would also be denial of that. Circular logic, but we can't do much better. If they're lying and just made up these numbers, there's nowhere to really go with that.

Why give false numbers when you can give true numbers for only a six month period? Just leave out the NSA request for all user data that was made earlier.

What people would be giving Facebook the numbers? Those are Facebook's own stats, compiled by their own legal department.

... or so says Facebook's legal department ;). How can we tell?

Simply put, we cannot.