He probably was able to get your profile picture by right clicking on your profile image and finding the location in Steemit's source code.
Which appears to be: https://steemitimages.com/120x120/https://scontent.xx.fbcdn.net/v/t1.0-9/18920400_668367393352551_3688540177037102664_n.jpg?oh=4621489e8bf230f0af5db3345d13221d&oe=59A113D5
Ah ok what else can you do with the source code?
Nothing that would allow someone to gain unauthorized access to your account, mostly just look at elements and see the markup that corresponds to them.
I tried that URL, and I found it myself in the page source, and the server will not allow it. But previous poster is correct, it can be a screenshot, then edited.
Funny thing is, the person you say stole your image, has 10x more posts and experience on Steemit than you; so if it's not a bot, then it makes no sense..