This is an extremely valuable reminder, and I would like to add one thing to it:
NEVER even use your Master password to sign in ANYWHERE!!!
The Owner's key and the Master password should ONLY be used for account recovery as you have clearly stated, that way if anyone does accidently click on a fake link, the thief may get a little out of your account, but you can recover it quickly and change the keys and password. But if one does use his Master password, as this is exactly what has been happening, the thief changes the account keys and password and bye bye account with all of it's assets.