Yes, we realize that if your e-mail is verified on Steam the “hacker” won’t be able to change the password but still he or she can get you VAC Banned and if you have shit loads of games like me it wouldn’t be very pleasant, would it?
You may think that “mehhh I don’t click links from strangers anyway” but that’s the problem, the new “hacker” takes over your friend’s Steam account and pretends to be your friend just so you could click the link – I know I would click on some random tinyurl.com link from my friends.
So yeah, be careful out there. I wonder what’s Valve going to do about it.
PS: This is not just me saying, here’s a random Steam Forums thread about it.