Troy Hunt has blogged a few times about the legitimacy of his service, and it's clearly been a carefully walked path to where it is today. I think ultimately i

Troy Hunt has blogged a few times about the legitimacy of his service, and it's clearly been a carefully walked path to where it is today. I think ultimately it comes down to the fact that he's not redistributing the lists of emails, and he doesn't retain pairs of (email + password hash). He designed the site to provide two useful queries ("what breaches included my email" and "has this password been seen in any breaches you processed"), which strike a responsible balance between disclosure and privacy. Moreover, he has written about his intentions and acted with a fair deal of transparency, which is a strong contrast to some of the shady behavior you'll see from people dancing in the gray areas of the law. That was probably a stepping stone to partnering with other organizations, which has snowballed into having the cooperation of the FBI, as well as the endorsement of multiple countries' governments.