how can they know the current Gox user/pass was found out from LastPass? I guess to them it would seem obvious of the gox acct was a new pass that only the current controller of the gox acct had. But, these are still questions that all need to have answers to them in order to make better determinations.
I see that LastPass has a way to view history, which if that showed login from an unknown IP address, that would be a pretty good clue.
I just tried to view the history but the LastPass UI for the date picker is so horrible I could not use it successfully. (Top-right is the Lastpass asterisk (starfish, ironically
) , then click History)