HIBP works fine when you check it every once in a while, but as a mechanism to reach site owners about urgent issues, they'd all have to subscribe to such a central reporting place. Not sure what the advantage is of subscribing to "has my site been pwned" as compared to just having a /security.txt, working WHOIS record, obvious contact page linked from the homepage... lots of ways already

Edit: I could see the benefit if they do vetting of the message though. Like if one person vets the message and then it makes it into 15000 inboxes is better than having to deal with 15000 antispam mechanisms. Maybe there's something to this after all. Or if email providers would act upon spam better and we block the ones that don't, maybe we could just not have spam in the first place. Idk why this is so hard in the first place