This simply has emails from other lists that have been floating around. For example, the adobe set is from the adobe breach where emails were in the clear.

The dark hat guys already have this list. And likely some passwords, which this site doesn't ask for.

That's the point OP was making.

They would know that you know that they know.

This means they could be very, very targeted with an email/social phishing attack to try and get a newer password or other account information by referencing the previously compromised site. It could help the bad guys establish trust. A bit tinfoily but well within the realm of possibilities if the lookups on this site are logged.

People who know "pwned" are probably more resistant to phishing attacks than the average schmuck.

Also, a lot of the material entered into the site will be fake. This is not a good way to harvest genuine e-mail addresses.

Not only is it open to fake addresses, but it is open to deliberate spam-trap addresses: addresses whose only purpose is to detect spam. I can generate a fake address "nothanks@<mydomain>" and feed it to this site (or, generally, allow this address to be widely harvested).

Then, whenever an SMTP request comes in with a "RCPT to: nothanks@<mydomain>", I can drop the connection and ban the IP address for 7 days. Any use of that address is 100% spam; no legitimate sender knows this address.

If I were to run this scam, I would only add addresses that were checked and matched a known leak. This would both give me a known good address and also an idea of what kind of person you are. If you're the type to check your email address against known leaks then I would know exactly how to attack you.