The problem is “just remember!” is not exactly foolproof. I have steam email set up for 2fa, they gave the account away regardless.

Actually, I don’t think I ever attached my phone number for recovery purposes, I suspect I added it as a step to play CS or DotA.

And then they parlayed it into an account recovery option.