Comment by EUROCARE

One way of checking is that emails and passwords/hashes might appear in leaks and then DBs like https://haveibeenpwned.com/