I’ve added the threshold. It defaults to banning the password if it appears at all, which takes care of both concerns.
Troy seems to have added the count in v2 as feedback:
Now on the one hand, you could argue that once a password has appeared breached even just once, it’s unfit for future use. It’ll go into password dictionaries, be tested against the username it was next to and forever more be a weak choice regardless of where it appears in the future. However, I got a lot of feedback from V1 along the lines of “simply blocking 320M passwords is a usability nightmare”. Blocking half a billion, even more so.
It still defaults to the functionality you describe, but admins can now tune to their liking.
Updated to read “has appeared previously in a data breach. Please use a more secure password.” which should address this.