I just tried the LastPass account. I didn't expect to be able to log in, but I was able to using the original credentials!
And LastPass didn't log the IP that reverted the master password. It's so weird.
From my understanding, it doesn't matter if the hacker didn't log into a LastPass account. That's because API key is the same password for a MtGox account.