In plain words
When a site a staff member signed up for is breached, its list of addresses and passwords is copied and shared. If the same password was used for work email, anyone holding the list can try it.
Why it matters to a firm
Stolen and reused passwords are one of the most common ways into a firm’s email. Changing the password and turning on two-step sign-in closes it.
The check behind the finding
Check one address at a time with a public breach-notification service.