I wasn't sure about account recovery considering I only looked steemd.com and it's owned by a pro-hive person who could easily be masking these transactions (steemd/hiveblocks isn't open-source!)

But I'll take your word for it, so it means that @anonsteem stored the keys of created accounts in their server. It means it's even worse than what I thought