Comment by ummonk

Salting (which they absolutely should be doing precisely to make mass dictionary attacks computationally expensive) would make that infeasible.

More likely they're just checking against the stolen passwords database whenever the user logs in, as passwords are typically submitted in plain text.