Attacking hashed password by timing attack and other means
Let's make things slightly more abstract at first.

The attacker knows $n$ salts $s_i$. Passwords have $e$ bits of entropy and are hashed to $h_i = H(s_i, p_i)$. The attacker can calculate $2^c$ hashes $H(s_i, p)$ per second and can query some kind of an oracle $2^q$ times per second for the prefix length shared by $H(s_i, p)$ and the target $h_i$.

Simplest would be if the shared prefix length was known to the bit. In that case when the attacker knows the first $b$ bits of $h_i$, they can look for a $p$ for which $H(s_i, p)$ starts with those $b$ bits ($2^b$ work) and by querying the server would find an expected 2 more bits of $h_i$. Thus, finding the $e$-bit entropy password would take about $2^{e-1}$ hashing work and $e/2$ queries on average.

If the length is known with byte accuracy, the attacker would need to query up to 255 times to go from knowing $b$ bytes to knowing (usually) one more. The hashing work would remain the same at $2^{e-1}$, but about $128(e/8) = 16e$ queries would be required. With $w$-bit words, the number of queries required would be about $2^{w-1}e/w$.

So, in cracking those $n$ passwords, the attacker would spend $n2^{e-1-c}$ seconds hashing and $ne2^{w-1-q}/w$ seconds querying. With your numbers of $n=16$, $c=40$, $q=10$ and assuming $w=8$, cracking even 70-bit passwords would require less than half a minute of queries total, which means it is negligible compared to hashing time for anything remotely secure and the attack is effectively offline. Only with $w = 32$ and larger does it start to matter – each password would require a month or two of queries at that point.

With prefix queries at byte accuracy and 44-bit passwords, the attacker would require 8 seconds of hashing and less than a second of queries to crack all 16 passwords. They might be limited by network latency and need several extra seconds due to that.