Agreed. But one of the team members explicitly released the source code and that caused the hacker to correctly guess LastPass account. (At least this is the most "right" version of the story I've heard.)