I checked someone who was part of the leak and the correct initials came up so unless that is by chance, it does seem to be querying the database. You can also read the source code [1] where it does an api call to get the data.

We can be pretty sure the results are legit but yes of course it could be running malicious code and stealing phone numbers. Check the raw data if you are worried[2].

[1] https://github.com/Fumaz/haveibeenfacebooked-api [2] https://archive.is/MZqak