These sources report to Proton any time they find leaked information or data stolen in a hack from a third-party online service that’s tied to a Proton Mail email address or a Proton Pass alias.

I’m inclined to think that they look for known data breaches using your email address or alias, and if found they will tell you what kind of data is associated with the breach; e.g., social security, physical address, etc. So they don’t need to actually know that information, because they’re not searching using that information.