Sort:  

But they can change their key, can't they? So it is no longer able to be abused.

Should they create a new steemit account at this point to avoid anyone missing their account?

No, actually I was wrong.. like @bex-dk mentioned, they can change their passwords and keys and should so immediately.

I should have mentioned that and totally forgot. Please change your password and keys if you have done this and you will be fine

I would add this bit to your post to complete its greatness!