FWIW if a fed has an account with the service (which is fairly likely for big services like Gmail et al), and knows the hashing algorithm (if they've successfully got the passwords this is pretty likely too) they could prove it easily by hashing their password themselves and comparing it to the stored version.