Beware of hijacking using email spoofing

The situation

One day you receive an email. It seems legit because the sender is noreply[at]support.steampowered.com, not those steamCORNmunity ones that you frequently see.

The problem

But it is NOT. Steam never asks you to download anything. Follow those instructions and you will lose your account for sure.

What happened?

The hijacker used a technique called "Email Spoofing", which create an email messages with a forged sender address. For further reading about email spoofing and how to protect yourself, read this article from LifeHacker, it's too long to be pasted here.
Original post from Reddit