Forecasting credential stuffing threats