Which "publicly accessible resource using email addresses from previous breach corpuses" are they referring to? Am I being paranoid that HIBP itself is a potential vector for this enumeration type data exfiltration?