I don’t understand how. If I record that my password for Google is xyzzy, but in reality it’s xyzzy123, and 123 is part of every password but not recorded anywhere (other than my mind), how would they work that out? They’d just see that none of my passwords worked. If there is a weakness to this system please let me know.

Unless the hacker mass decrypts a couple million passwords, in which case one person's passwords that don't work for the login bot probably won't catch the hacker's attention.