How would Google do it with an algorithm to tell whether a database is leaked or not? Get emails from the firm to assess it? Maybe a honeypot email?

In that case, it seems far more easier for developers to put in honeypot emails in the databases and constantly query search engines hourly when those become available.

That is assuming database gets released, let along exposed for indexing.