Can it tell me which of my users have weak passwords?

Yes, once each of them has signed in. It cannot read the passwords stored on your site: WordPress keeps a hash of each one, not the password, which is what makes a stolen database hard to use, and nothing can read a hash back, including this plugin.

But it sees each password once more, when its owner signs in with it. Switch on Refuse passwords a machine would find in Settings, and from then on each sign-in by somebody the rules apply to is judged by the same rules as a new password. With Applies to on People who can change the site, the default, that is your staff and not your customers. Nothing is judged over XML-RPC or with an application password. A password the rules refuse leaves a note on the account, and the person is asked to change it on every admin screen (or on My Account, for a shop's customers). The password itself is never stored.

To see who has one, use the Weak password link on Users → All Users, the count under Settings → The password itself, or wp login-security weak. Each lists only the people being asked, the roles the rules apply to. Make them change it before doing anything else keeps them on their profile until they do.

Somebody who has not signed in since you switched it on has not been judged yet. For them, Users → Send password reset still works: each person picks a new password, and the new one has to pass the rules.

If you lower Shortest allowed (Settings → The password itself), anybody whose password was only too short for the old length stops being asked, counted or listed as soon as you save. Their password may be long enough now or may not, so the next time they sign in it is measured against the new length, and they are asked again if it is still too short.

People told before you updated the plugin were told without the length being kept. On a single site, the first change you make to Shortest allowed after updating gives them the length you had until then, and from there the paragraph above applies. If you had already lowered it before updating, they are asked until they next sign in. On a network, they are asked until they next sign in.

Be wary of any plugin that claims to sweep the passwords already on your site. It is either guessing them, which means running a cracker against your own database, or it is not doing what it says.