There was a problem in counting how many hits a given password had (see #1 for details). It was counting all hits for all hashes returned by [HIBP](https://haveibeenpwned.com), not for the password hash itself.