So basically if I put somebody's email address I could know the sites they have logged in in the past?
And then I can use the leak and get access to their account? Shouldn't this information be mailed to the email address queried rather than displaying upfront
As topranks mentioned, all this data is already available and anyone could download it.
However, in most leaks, you can't just use the information as the passwords are (hopefully) hashed/salted. That said, it is trivial to crack md5 if passwords are stored using that method.
Also, not all leaks contain passwords, some might just be lists of email addresses or other information.
This is a fair point and it has to be weighed against the value of the data to the individual. I generally feel they have struck the correct balance but if you think different approach is warranted you should explain it and why it better balances these different needs.
And then I can use the leak and get access to their account? Shouldn't this information be mailed to the email address queried rather than displaying upfront