The LastPass Team states the following in their FAQ:
Do you use a salted hash for logging in?
Yes, we first do a 'salt' of your LastPass password with your username on the client side (on your computer, LastPass never gets your password), then server side we pull a second 256 bit random hex-hash salt from the database, use that to make a salted hash which is compared to what's stored in the database.
Does anyone know if the part "we first do a 'salt' of your LastPass password with your username on the client side" is meant literally?
According to this answer it almost looks like this is the case:
From these details, my best guess is that the LastPass decryption key is calculated by:
DK = PBKDF2(HMAC-SHA256, password, email, <user set>, 256)
Since this appears to be Pseudocode I can only guess that the third argument for PBKDF2 is the salt.
I realize that the right thing to do would be to run email through PBKDF2 to make it more suitable as salt. This is of course where the cat chases its own tail which probably forced them use the email as salt in the first place.