Recently, a user's Steem account was hacked. The thief added himself to the victim's active key authorization. Furthermore, the thief set the victim's vesting withdraw route to himself:
This means that if the victim starts a power down, the STEEMs will go to the thief's account directly. The victim was not aware the the route was set to the thief's account.
The suggestion
To protect the victim, steemit.com should have an option to display the vesting withdraw route.
steemit.com can always show the vesting withdraw route in user's wallet page, when the route is set to another account.
When a user starts a power down, and when the route is set to another account, steemit.com should give user a warning that the route is set to another account
When a user changes owner's password, steemit.com should check the vesting withdraw route and give user an option to clear the route.
