Seems like all they can do is match usernames to emails at this point, if the passwords were properly obfuscated. Although... session tokens are gone, but coul

Seems like all they can do is match usernames to emails at this point, if the passwords were properly obfuscated. Although... session tokens are gone, but could have been exploited during the window between the hack and the token purge, right?