Yeah, I hope it was social engineering (seems a better option than hacking Lastpass :-) ) but not sure how they could have done it given the information that was on the account/unique to the account. Will be interesting to see if Instagram return the account to me.