No DuckDuckGo calculando o hash sha-512 da string "João da Silva" resulta:
fab687418ca251d4cfb079de71d44200ef56d637982b56d2df2d1f78ffc6106f8a2fee050f9c1e0b359e618ba890ef0d0e0b3e428186d95077d185b23a32ecd9

No Linux:
$ echo -n 'João da Silva' | sha512sum
d2975f13e399daa60bef015d3264fc2cb4368793d4e09ae889e86dd36960e24c7fd73018499b4197a45f275ad2b903fa3293a9460696bc3227a5fff7ca0c50e7 -

No site https://md5calc.com/hash/sha512/João+da+Silva obtenho o mesmo resultado do Linux.

1. Dependendo do método usado no script pwned-antifas parece-me que o hash gerado por eventuais usuários pode nunca coincidir com o da base de dados, gerando sempre falso-negativo.

2. Como o DuckDuckGo trata a string para calcular o seu hash ?

Why not process the text from the names before creating the hashes so you turn everything to lower case or upper case? This would make the search easier and less time consuming. Also would grant a more accurate result. Would need to explain in the webpage that is needed to hash the user name in the same pattern processed in the tool instead of advising to do multiple searches.