I think it's reasonable that you chose that title based on the email header, and I also think it's very irresponsible of haveibeenpwned to send out an email with that subject line. They absolutely should know better.