Due to the fact how little 500 million passwords is out of the entire set of all possible passwords (even with single digit length) the 1 in 1000 false positive rate is extremely high actually.

See my other comment: https://news.ycombinator.com/item?id=17323068