Whether or not you need to change your password is highly variable by site, even among those sites affected by Heartbleed. Basically, during the period of time where the site in question is vulnerable, hackers could have read random chunks of memory out of the server. Maybe that memory would have contained usernames and passwords; on the other hand, maybe the way the server handles authentication transmission would be such that the memory would be nonsense. Quite a lot of servers never transmit authentication data in plaintext, even inside of SSL/TLS, so compromising SSL doesn't give the hacker anything.
Your best bet is to sit tight for the next week or so, change your password if you get an email from a service explicitly telling you to, and then if not consider changing your passwords then.
Lastpass, along with KeePass and 1Password, are all great password managers. Any password manager is better than no password manager. Use strong, long, random passwords for every site and only memorize your master password, which should be as strong as possible.
Note: This advice is assuming you already use different passwords for every site. If you reuse passwords, well, stop doing that.
Just under the cutoff for the top 10 (147 is your total giveaway number), but remember that the giveaway number only counts claimed giveaways, not outstanding giveaways, so if someone gave away 200 desura copies of My 1st Gam or whatever and no one claimed them, they'd show up as giving away nothing.
I don't believe there's any way to get a numerical stat, but if you check the Modbot tutorial for a my loot request, that should show you a complete inventory of everything you've won and given away* and you can do the counts yourself.
* Games that were rotting, unclaimed for a long period of time and given away through a bulk Modbot giveaway are counted as being given away by Modbot, not by the original giver, so those might be missing.