Interesting - so it's a known scam. It's the first time I've seen it.

And no, no passwords were quoted or suggested. Possibly, as you say, because there are none with the honeypot addresses, although all the addresses have used services, so can have passwords.

How long have these accounts been out there though? As an example, I changed email addresses a few years ago, and have yet to get a breach notification at my new address from HIBP, though I somewhat regularly get notifications for my old one(s). This tells me that the majority of breached password data is at least a few years old.

And yeah, it's known, but still relatively recent. I probably first heard about it two or three months ago.

These addresses have been out there quite a while - certainly more than 5 years, possibly as much as 10, and maybe even 15 in one case.