Actually the data stored at their server will be encrypted with your 2048 bit key. So even though you might have uploaded warez to their server, they won't be able to see the content of data. Essentially that spares them of any legal action against them even if some goes to see through their HDDs because the data will be encrypted.
Actually, Ars Technica found some interesting "features" which may compromise your innocence if you're uploading pirated stuff.
Firstly, Mega claims that they do not know what content you upload. However, their servers check for redundancy (deduplication). So if you uploaded the same file as another guy, only one copy will be stored. But this begs the question: how will they know if the files are identical?
During startup, when it is generating your 2048-bit RSA key, apparently JavaScript's inbuilt random number generator is used. And computers by themselves can't do random stuff. It is only pseudo-random, and can be reverse-engineered if the likes of FBI were so inclined. Also, when the site claims that it has collected keyboard/mouse entropy, it is still reading those moves. So, most people won't jiggle their KBs/mice.
Your files themselves are encrypted with AES-128. The 2048-bit key is used when you send files or messages to other users.
Password is not changeable. If you lose it, you lose your files.
Link: [arstechnica.com]