- Scan for malware. https://www.malwarebytes.com/
- Deauthorize all devices https://steamproxy.com/steamstore/twofactor/manage
- Change your password on a secure device.
- Generate new back up codes. https://steamproxy.com/steamstore/twofactor/manage
- Revoke the api key https://steamproxy.com/dev/apikey
- Refrain from giving away your credentials to phishing sites

The API key is used to control trades on your account. If the key is compromised, hijackers can cancel, send bogus trade offers and redirect items you trade to their account which is why items get stolen. The API key field should really be blank.

Also ALL steps here must be completed in order and without fail to properly secure your account:-