Disclosure: I work on MongooseIM.
I recommend one of the Erlang-based servers: either MongooseIMMongooseIM or ejabberdejabberd. MongooseIM was originally a fork of ejabberd, but the codebases have diverged quite a bit in recent years.
These servers stand out among the other options not in terms of feature-richness (they do offer lots of features, though), but because they leverage the scalability mechanisms offered by the Erlang/OTP platform. To address your points:
is scalable
Erlang is amazingly scalable. WhatsApp is the latest poster child for Erlang scalability, but if you google around, you'll find lots more.
can handle between 10 and 15 million users
If you want to scale to millions of users, be prepared to build a cluster of beefy machines with lots of RAM (both these servers are memory-bound). There are deployments in the wild with ~2 million users that I know of. The League of Legends chat runs several federated clusters that handle 70 million users, but they're using a very heavily modified ejabberd.
runs on Linux and/or Windows
You're probably better off running on Linux. Erlang does work on windows, but I'm not sure how well large-scale applications perform on the platform.
is Open Source
Yes, both are open source, licensed under the GPL.
