I am no security expert, though there is a simple step that Steemit can take right away so as to reduce users' accounts exposure. The same solution we have applied on Wordpress installations some years ago when faced with extraordinary number of attacks.
It should be allowed to users to choose the nickname under which they will publish their posts, using their usernames just for signing in. This way a potential attacker will have to also steal the username, before trying brute force. In that case the prompt after wrong credentials are introduced should not give any clue of where the problem is, username or password.