Perhaps it's not about changing your key but about how, where you save it and how easily you click on the wrong button, how many other tools are used where keys are asked (only posting keys can't do much harm). I have strong doubts change of key will avoid this unless the keys were stolen before the hard fork. That can be figured out.
If all those abandoned hacked accounts started before the hard fork...
If not the question is... how can an owner and master key be changed with only a posting key? Or is it in all those cases the active key? If that's the case what do these accounts have in common? Using the same keychain, an old fanbase, did they use another Steemit tool to post on Steemit, were these accounts active during the same period (active as in stealing keys).

Or are these two operations? 1. emptying wallets of abandoned accounts with the keys stolen during the hard fork and 2. keys stolen during... of more recent accounts.