there's countless exploits for lastpass. it's definitely possible they logged in, even without having your password. i remember seeing a list of like 10 lastpass exploits