Wouldn't bad actors just push their fake email addressess to haveibeenpwned in fake leaks? Steps:

1- periodically set up a legitimate looking service, possibly proxying real services. 2- wait a year or two for your fake service to premiate throughout the www and for seach engines to index it. 3. Mix your bot email addresses with legitimate previously pwned addresses. 4- proclame "woe is me, for thyself hasth been pwned"

You can set up this process so that you can inject a couple 100k bot email addresses periodically every couple of months.

This is an incredibly shortsighted idea with the potential to hurt a lot of innocent people.