> In the end they said the checks are done locally—by downloading dozen-gigabyte leak archives like the exploit.in, I guess?

I would guess they are doing the checks with a technique called k-anonymity. It doesn't require sending the password, nor does it send too much data to the client. Troy Hunt offers a service using this technique.