That's why I like having my own domain.

* If prompted for an address just make something up, with the name referencing the purpose, (e.g. forslashdot@example.com)
* Unique email address for any site/other purpose. Since they're unique to any entity you know exactly who got breached.
* With a catch-all you can make up addresses to use but don't actually have to create the addresses on your end because you'll just get the emails.
* You can reply with that unique address in kind, even though that address doesn't actually 'exist'.
* The catch-all will get all mail addressed to your domain so it's handy for times people might misspell something.

(Some people sh|t on the idea of catch-alls but I've been set up that way for over 8 years and I don't get any spam.)

One nice thing about haveibeenpwned is you can do a domain-wide query (provided you can prove it's your domain) and it'll tell you which email addresses, if any, have been seen in a breach.
After you've verified that once haveibeenpwned will notify you of any future breaches so you don't have to occasionally go back to check.

Where do I claim my million dollars?

Exactly. The same could be said in regards to private Facebook profiles.
Nothing stops someone that is part of the private group to make available anything that they see to others not in the group. eg., Save the page, the text, pictures, screenshot it, etc.