I'm also curious about the 30 days so I actually dug into the steem code and found this:
Being able to satisfy an owner authority that was used in the past 30 days is sufficient to prove past ownership.
It sounds like you need to just login every 30 days, not necessarily change the password, but it's still a little ambiguous. This is the best authority I could find so if anyone more knowledgable sees this, please comment and help us all to understand!
I by no means am a SteemIt expert, I'm still a minnow, so if I did have it wrong by all means someone correct me. This is how I understand it, because of a steemit post by @someguy123 that reads:
"The important thing is the recent password.
The STEEM blockchain knows the history of your account, and every owner key that has ever been used for it. When you enter your recent password, it uses that to generate an owner key that can match up to a previous owner public key on the account. Without that password, the trustee cannot do a thing...Small note: The "old owner key" has to be recent, which as far as I'm aware means active within the past 30 days (someone please correct me if I'm wrong)" Read his full post here
Again, this is just how I understand it. After this I am going to change my password recently to prevent this, just to be safe.
Oh, I guess it does say "active" within the last 30 days... so looking into the logistics of what that means might be helpful.
.