I by no means am a SteemIt expert, I'm still a minnow, so if I did have it wrong by all means someone correct me. This is how I understand it, because of a steemit post by @someguy123 that reads:

***"The important thing is the recent password.
The STEEM blockchain knows the history of your account, and every owner key that has ever been used for it. When you enter your recent password, it uses that to generate an owner key that can match up to a previous owner public key on the account. Without that password, the trustee cannot do a thing...Small note: The "old owner key" has to be recent, which as far as I'm aware means active within the past 30 days (someone please correct me if I'm wrong)"***[ Read his full post here](https://steemit.com/steem/@someguy123/how-the-steem-account-recovery-works-and-why-your-trustee-can-t-steal-your-account)

Again, this is just how I understand it. After this I am going to change my password recently to prevent this, just to be safe.