and when they have an md5 on the net that matches the one for my password, how am i now compromised ?

they still haven't put it together that that md5 is my password. they only put out what 'xxxyyyzzz' looks like when it's md5'd