It's clever in the way that if your password does not appear in the dataset the service doesn't have much information (or really any information that could be used to get your password).