They could check the user's password against the HIBP database - many users aren't aware of these data breaches and this would prevent them using one of those p

They could check the user's password against the HIBP database - many users aren't aware of these data breaches and this would prevent them using one of those passwords as well as making them aware of the problem.