Users with leaked credentials

Not sure it will help but here is the official explanation of leaked credentials and how Microsoft matches one of these users:

"When cybercriminals compromise valid passwords of legitimate users, the criminals often share those credentials. This is usually done by posting them publicly on the dark web or paste sites or by trading or selling the credentials on the black market. The Microsoft leaked credentials service acquires username / password pairs by monitoring public and dark web sites and by working with:

• Researchers
• Law enforcement
• Security teams at Microsoft
• Other trusted sources

When the service acquires username / password pairs, they are checked against AAD users' current valid credentials. When a match is found, it means that a user's password has been compromised, and a leaked credentials risk event is created."

This is from https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-risk-events by the way.  This isn't foolproof, it's just what Microsoft can acquire and potentially match.