It points anyone who has an email address to specific leaks that have that email address. These leaks contain additional data beyond the email address, like pa

It points anyone who has an email address to specific leaks that have that email address. These leaks contain additional data beyond the email address, like passwords, location data, message contents, etc. This enables bad actors to quickly and easily figure out which leaks they need to go look at to find further data related to the email address they searched on. It'd be a great service if it hadn't spent the last decade deliberately ignoring a fundamental principle of security: Assume there will be bad actors. It takes a bit of cognitive dissonance to leave the problem unaddressed for so long. eg, if you assume there are no bad actors, there's no need for the service to exist. And if you assume bad actors DO exist, the service needs to protect its core functionality better against being an engine for abuse.