I'd presume that are checking passwords that leaked in plain text or with weak hashes, or potentially just matching user names and airing on the side of caution

I'd presume that are checking passwords that leaked in plain text or with weak hashes, or potentially just matching user names and airing on the side of caution. I can't imagine most companies proactive enough to check leaked data would choose to store in plain text.