Also more likely to be a leak from some account harvester / malware / ... rather than D+ getting hacked.

Shame on D+ for not screening passwords against known hacked u/p.