I imagine a better alternative would be, having identified an attack (via rate or otherwise), to let the attacker try their list, and for each successful passwo

I imagine a better alternative would be, having identified an attack (via rate or otherwise), to let the attacker try their list, and for each successful password match deny access (indistinguishably from an incorrect password), silently invalidate the password, and email the legitimate user.