mark found hashes and only write the not-found hashes to disk, rather than not
writing *any* hashes (when any match) because the message is a "dupe".
When update is false, the behavior is the same as before.