Your #1
The have I been pwned db of passwords is part of Passbolt. If a Password is in the db you will get that message. Script kiddies use those password dictionaries to have fun. So it is a good idea not to use a password if it is part of a dictionary (database) https://haveibeenpwned.com/
Your #2
Can you please run health check and post any logs info.