I wonder if there’s a new leak out there with actually recent passwords we just haven’t heard of yet. If Apple got their hands on it and confirmed a significant number of passwords were active then taking drastic measures is their only option.
> taking drastic measures is their only option.
Less drastic would be to come clean and say the lockouts are by Apple themselves.
On the third hand it is an apple leak, they've been given a sample list by whoever is ransoming them so they've enacted overly strict heuristics that apply to everyone.