Neither SteemConnect nor Utopian have access to any of your keys.
But they have access to the account to which you delegated your full posting authority (via the ability to create 'tokens' that can upvote/post for you), so it's exactly the same as them having your posting key. Hence what happened today.
RE: Automated votes abuse on SteemConnect?