As I understand it someone at Steemit Inc has to verify your account and then they delegate to your new account (possibly from the @steem account). It is nothing to do with the witnesses. I think that delegation lapses at some point and can be withdrawn earlier if the account is reported for abuse.
Anyone can create accounts if they have enough resource credits. I have claimed loads that I can give away, but they do not come with any SP delegation by default. This is why I have delegated to accounts I create.
I know a lot of people have lost keys. I think it is made fairly clear to people that it is up to them to save them, but we are used to being able to recover accounts easily on other platforms. It's harder on Steem.