I think it’s genius, but evil. Like you say, real email addresses have all been pwned so this is a way to test for bogus or typo’d email addresses. What a way

I think it’s genius, but evil. Like you say, real email addresses have all been pwned so this is a way to test for bogus or typo’d email addresses. What a way to ruin a wonderful thing! Abusing the haveibeenpawned service in this way has worried me enough that I’ve now gone and removed my data from the publicly searchable database. I’ll use the notification service instead.