319
Have I Been Pwned adds 284M accounts stolen by infostealer malware
(www.bleepingcomputer.com)
This is a most excellent place for technology news and articles.
Then they must have tried your password and saved it to one of a specific number of places. Infostealers are by definition a class of malware, which means it's got to be installed somewhere with access to the directory storing the credential.
Or it was from an old computer, or mislabeled.
https://www.youtube.com/watch?v=L3f9do5mtT8
Here's a good talk on infostealers for anyone curious.