Credential stuffing attacks are detectable and preventable, which is what you're describing. When detected (trivial with the right tools), you can then require users to reset their passwords for the suspected accounts (with the traditional "check your email for reset link" dance).