You don't need to cross-reference the passwords. Matching email addresses are sufficient to warn the user. The user should be able to verify whether or not the two accounts use the same password.