There is a new method of Phishing out there, and that is uploading a SSFN file to bypass steamguard and let the guy get access to your account.
Naturally, this means they transfer everything in your inventory to theirs.
It all started when a Russian steam group that randomly added me posted a steam community link. Deciding to log in, I had to upload a SSFN file for steamguard. I noticed right after uploading the file that Steamcommunity.com was spelled Steamcomm
ITITY.com, and that it was a phishing website. I instantly changed my password, email password, and de-authorized every steamguard computer. Steam Inventory says I have no TF2 items, but in TF2 I still have all my stuff.
http://www.reddit.com/r/Steam/comments/1yw25k/psa_new_phishingscam_technique_on_fake_steam/ might help.
Any advice you could offer to avoid letting this happen? What should I be looking for? Aside from the obvious misspelled URL, which means that it is too late, if in right.
Never upload SSFN files to steamguard.