Hmm - I definitely changed my passwords, but I didn't have the old active key written down.

I went through and found the actual transaction and update notice from streemian:

Then found only one other update:

That's all I can see as far as updates go, and neither seem to add any authority to the active or owner slot. This doesn't alleviate my concerns that they are collecting active keys, but if I changed my active key twice, that original should no longer be useful if I'm understanding correctly.