It depends what you mean by "leak". If someone was running keyloggers and collecting passwords and they published them, that can also be a leak, and it doesn't

It depends what you mean by "leak". If someone was running keyloggers and collecting passwords and they published them, that can also be a leak, and it doesn't matter how the passwords were stored. And not just keykoggers, but this also applies to phsihing, man-in-the-middle attacks, or other similar ways of getting passwords from end-users.