It would be impossible for the site to have every password ever compromised.

It can only check against a database of known password leaks.