We haven't found a way to prevent large-scale automated account takeover attacks using leaked password databases.
open
Global / Unspecified, Global
WS00854
Attackers can automatically test massive numbers of previously leaked username and password combinations across many websites to find accounts where the same credentials still work. Reducing the effectiveness of this widespread technique remains an unresolved security challenge.