For those who are just being exposed to this stuff, This Is How They Tell Me the World Ends: The Cyberweapons Arms Race by Nicole Perlroth was an entertaining read that covers some of the history in this space.
Google. Outsources. Security.
The kind of thing that makes it seem miraculous that any of it is still standing.
That said, I cannot recall Google ever having a breach, a la Yahoo, Sony, and basically most other companies. Does that mean everyone else should use who Google is using?
Mind you with salt and pepper (roughly, ways to modify the hash and overcome rainbow tables) checking anything other than the very highest frequency passwords found would seem onerous.
More likely they're just checking against the stolen passwords database whenever the user logs in, as passwords are typically submitted in plain text.