Question: does have i been pwned work?
Answer: How do I know the site isn't just harvesting searched email addresses? You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.