I just checked HIBP for the email I used with Alby and it shows up in 0 data breaches, so my email was definitely leaked via the password reset mechanism on your site.
Iām not stressing about that too much, but you should be careful about deflecting too much blame.