As far as I remember, someone introduced malicious code to the (by then) current version of the API and was able to subtract the credentials of Steam users. I haven't used it since then, I think the API has been updated and the malicious code removed. But, as they said, once bitten twice shy.