Calculating permutations for a specific password policy The security researcher Troy Hunt posted an example of an obscure password policy and I've been trying to figure out how to calculate the possible permutations 
(Source: https://twitter.com/troyhunt/status/885243624933400577)

The rules are:


The password must contain $9$ numbers (and only $9$ numbers)
It must include at least $4$ different numbers
It cannot include the same number more than three times


I understand the basic permutations will be $10^9$ ($0-9$ nine times) $= 1,000,000,000$

What I don't understand is how you factor in the reduction in permutations by enforcing $4$ different numbers and limiting repeats to $3$.
We calculate the number of valid passwords with the help of exponential generating functions.


  At first we are looking for strings of length $9$ built from the alphabet $V=\{0,1,\ldots,9\}$ which contain a digit from $V$ no more than three times.
  
  The number of occurrences of a digit can be encoded as
  \begin{align*}
1+x+\frac{x^2}{2!}+\frac{x^3}{3!}
\end{align*}
  
  In the following we denote with $[x^n]$ the coefficient of $x^n$ in a series. Since we have to consider ten digits building strings of length $9$ we calculate with some help of Wolfram Alpha
  \begin{align*}
9![x^{9}]\left(1+x+\frac{x^2}{2!}+\frac{x^3}{3!}\right)^{10}=916\,927\,200\tag{1}
\end{align*}


The second condition requires at least four different digits for valid passwords.


  We respect the second condition by subtracting invalid words from (1).
  
  
  We observe there are no words of length $9$ which consist of one or two different digits whereby each digit does not occur more than three times.
  We conclude the only type of invalid strings of length $9$ counted in (1) is built of words with three different digits each digit occurring exactly three times.
  


There are $\binom{10}{3}$ possibilities to choose three digits out of $V$. The first digit can be placed in $\binom{9}{3}$ different ways, leaving $\binom{6}{3}$ different possibilities for the second digit and $\binom{3}{3}$ for the third digit.


  We finally conclude the number of valid passwords is
  \begin{align*}
9![x^{9}]&amp;\left(1+x+\frac{x^2}{2!}+\frac{x^3}{3!}\right)^{10}-\binom{10}{3}\binom{9}{3}\binom{6}{3}\binom{3}{3}\\
&amp;=916\,927\,200-120\cdot 84\cdot 20\cdot 1\\
&amp;=916\,927\,200-201\,600\\
&amp;=\color{blue}{916\,725\,600}
\end{align*}
First, each number can appear at most 3 times. So we are choosing 9 elements from

1, 1, 1, 2, 2, 2, ..., 9, 9, 9.

Then, there must be at least 4 kinds of numbers. It's impossible to have 1, 2 kinds of numbers. The number of 3 kinds is 9 choose 3.

So 27 choose 9 - 9 choose 3 = 4686741 is the final answer.