It's simple enough. They
They run a batch job that checks every password in the leaked list and yours matched. That verification is done exactly the same way as when you manually sign in.
As you can see, they then reset your password and notify you.