I don't think it was anything you did. I think they scan steemworld to see which accounts are the most liquid. Run a line of script, pull the data and they have what they want. Once they have that and obviously they have the know how to hack passwords, there isn't anything you can do.

Sadly, as long as there is 'money' there will always be people who steal it. I am so sorry this happened to you. I am more upset at the fact they were sending out phishing comments. That to me is a personal attack it destroys your reputation. Not just the system we use but true reputation. It's a great thing to have the community we do, since most of us know you would never do anything like that. I know if I saw something like that with your name on it , I would have been in discord asking what was up.
Glad that @guiltyparties was able to get your account back to you so quickly.