That conclusion doesn't necessarily follow, fwiw. If you find a password list, then you hash all the passwords and see if any match the hashes you store, now you know if the password found online belonged to someone on your system but at no point did you keep your own system password in plaintext.

Mind you with salt and pepper (roughly, ways to modify the hash and overcome rainbow tables) checking anything other than the very highest frequency passwords found would seem onerous.