I agree that active malware is still a possibility. However:

I was in touch with a security researcher on Twitter who has access to the RedLine Stealer stolen credentials.

Neither my email nor LastPass password (the one that was compromised) were in there. The researcher looked for another email/password (of someone else affected who reported it here on HN and contacted me via email) and no result as well.

Best way to confirm this?

10's of GB of credential data is being harvested daily, and personally I think these stealer logs are the greatest security threat at the moment <insert usual lecture about 2fa / unique passwords here>.

To confirm, you would have to basically get access to all the stuff that has been sold, as the malware is pretty widely sold and distributed it is effectively ad infinite data set, and constantly growing.

A previous responder checked with a security researcher who has a Redline Dataset and was not in there. Some of the annecdotes suggest it is from an old breech likely before 2020. Given the age and how these things get bought / sold / compiled into bigger datasets, there is a fair chance that researchers have the data and hopefully lastpass can dig into it to find the source.