I don't think there's any risk of someone stealing your kbin account with this, however I do think that admins can access more data than normal users, including from federated instances. They where only logged in on the web, and I think you can only access that kind of data by accessing the database more directly, which the exploit wouldn't have allowed the hackers to do.