You could lock the account and require a higher standard of proof of identity to recover it (e.g. you prove who you are and steam runs a credit report on you and validates your prior phone numbers and addresses against authorization and billing information that they have for the account--that would increase the barrier to require identity theft which is unlikely to be used just to take over steam accounts and spam).