Doesn’t haveibeenpwned offer a service where you can check a password hash against known pwned passwords? Maybe it would be possible to proactively prevent use of previously pwned passwords (apologies for the accidental alliteration.)