Just yesterday I received a notification from Facebook that my account had been accessed from a suspicious location and was locked as a security precaution. I had no idea how this could have happened, but I did have the same email address + password for Steam and Facebook. Hardly proof, but certainly a plausible theory.