If the LastPass documentation is kept up to date with their source code, then you don't have to worry about false positives. (You may want to be concerned about false negatives instead.) Detecting a form which is sent via
mailto: is a comparatively easy task.
GET request in HTTP (and HTTPS) is the most simple and widespread request method. It transfers (almost) all your data in the URL, i.e. in the same line of letters which is displayed in the address bar of your browser. Sending a form in an HTTP(S)
GET request is not safe: here are the possible consequences.
The other method, dubbed
mailto, is not actually an HTTP(s) request method, but rather a way to send your data via e-mail instead of a browser, HTTP and World Wide Web. Sending sensitive data via e-mail instead of an HTTPS
POST request might be even less safe.
If you really have to use a Web site which does it either way, better a) evaluate your options and try to choose a site's competitor instead; b) read two links just above and evaluate your risks.
Regarding AJAX, it's basically an abstraction layer on top of HTTP(S). It might easily be implemented with
GET requests: Wikipedia has a perfect example of this. So using AJAX alone isn't relevant to the question.
LastPass authors most likely are well aware of the fact that there are (sometimes, important) Web sites which do not follow best security practices. Thus, LastPass is not going to prevent using those Web sites at all costs, it just highlights an issue and leaves the burden of decision making for the user.
Sometimes, indeed, using
mailto: is somewhat (arguably, but) less of an issue. E.g. when the e-mail message is being sent to a device on
the local network, or when a
GET request ends on the localhost. LastPass cannot reliably detect those exceptions, here's why it only displays a warning.
I believe that if LastPass has detected usage of those methods, you can be pretty sure that either of those methods is, in fact, being used. Developer tools ("network" tab) may help to track it down.
Once again, using AJAX alone doesn't mean that the form isn't being sent in a
GET request. It might be either way. Pretending that a Web site isn't using
GET requests because it's using AJAX is plain silly.