First, after looking at the blockchain for my account it appears fairly unequivocal that streemian did do as it said and used the active code only to add themselves as a posting authority. Confirming this, with two password changes, leaves me confident funds cannot be accessed
To @xeroc 's credit he responded below in detail, even while on vacation, which I appreciate. Moreover, Streemian does not appear to have done anything untoward or unasked for to my account.
As expounded upon in the comments below, i think, for new users especially, the initial language on the streemian registration app is a bit misleading - really just enough to confuse and then frighten a person, like myself, who didn't really understand what the active key was. Secondarily, the permission removal webapp is currently down.
@xeroc offered alternative solutions to removing the posting permissions - piston and a similar tool - but I think for the technically uninclined that might prove fairly difficult. There's a tutorial here to begin with.
Long and short of it though I'm downgrading this from crisis to mistaken crisis. For other new users, read this before you hand out a key to anyone for any purpose.
Then you can avoid annoying a guy on his vacation and having a bloody ulcer.