We are not sure what happened, but as written in our Terms of Service - Smartsteem provides no insurance and assumes no liability for STEEM or SBD held on smartsteem.com
You don't have to share your password - memo-key / posting-key is sufficient. And those could have been very well compromised.
RE: Disabling Withdrawals to 3rd Accounts (Only enabled with manual verification)