Every other endpoint requires a subscription. This is very far from “The API is free”.
> searching by account wouldn't tell you anything useful
The API can return the domains listed in stealer logs for a specific email address: https://haveibeenpwned.com/API/v3#StealerLogsForEmail