They can modify it to simply say whether your account was compromised, regardless of whether you have an account (ie, if no account -> not compromised).
...Which they ought to do. Offering the ability to enumerate user accounts is unlikely to be the immediate goal of this utility, but it's an effect nonetheless.
