How long have these accounts been out there though? As an example, I changed email addresses a few years ago, and have yet to get a breach notification at my new address from HIBP, though I somewhat regularly get notifications for my old one(s). This tells me that the majority of breached password data is at least a few years old.

And yeah, it's known, but still relatively recent. I probably first heard about it two or three months ago.