You are currently allowing your users to choose their own password, and many of them are using the same password they use on other services. There is no other possible way your users are vulnerable to credential stuffing.

t’s important to emphasise that if you don’t reuse passwords, you are literally immune to credential stuffing.

Credential stuffing is a serious attack vector that is underrated because of its unintuitive nature

Defending against credential stuffing attacks

Credential stuffing is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts.