This is avery long read, to be honest. But it is worth it.
Personally i make sure to summon @steemcleaners/turning over to their report portal, and reporting anything i find suspecious.
Your advice here is as useful as it gets.And timely, i might add. Because yes, there is so many of those phising attempts taking place currently, you just cannot tell when next they might lure you to unknowingly give out your account credentials.
And then, just to be on the safe side, it is smarter to make sure you use your posting rather than master key even here on steemit. Just in case.
Meanwhile, just so you know, @asapers led me here! Cheers!