Here, let me simplify that code:

  def has_user_been_pwned(email):
      return True

There. It's nearly impossible to be on the Internet at all without having some account or another be involved in an exploit at some point. You could rename the endpoint `user_had_a_facebook_or_twitter_or_linked_account_or_has_a_credit_score()`. This is a worthless thing to query because it tells you absolutely nothing about the owner of the address.