A couple of days ago, to my utter surprise, I found out that I own a phantom Steam account.
I received one of those "Your Steam account: Access from new computer" messages and was horrified: despite all the security precautions (password manager, generated random password, offline database, Steam Guard authentication, etc.) someone had got into my precious Steam account. I was naturally suspicious of the email, checked its authenticity by examining the headers and content, but it was all legit. It really happened.
It took me a while to notice that the account name is not the one that I use on my Steam account. I used my alternative very similar alias, since when I created my account, my usual unusually unique nick had already been taken. I now know why. At some point back in time, as much as 10 years ago, I somehow created another account. The original one. Some Russian managed to brute force the password of that account, logged in, generating the email I received this week. It took a decade for this to happen. I guess I should thank the guy.
What bugs me is that I do not recall ever creating the first account nor is there any email trail of this ever happening. I have never had to wipe the linked Gmail account due to space constraints, since it just kept growing, so I have all mail I ever received through Gmail and the oldest emails predate the creation date of the phantom account - I was able to confirm it through Years of service badge after taking control of the account.
I only found two emails from the day of the phantom account creation. Quite suspiciously they are both from Advanced Micro Devices (AMD) and are related to ATI Customer Care Account creation (a thing back in 2007, apparently). The two games in the phantom account's library (Half Life 2 Lost Coast and Deathmatch) were not bought, but received as a gift - on this same day. The email tied to the account had never been verified. In fact I received zero emails from Steam until 2011, when I registered my main Steam account (in a slightly angered state, since someone had the nerve to pose as myself, now confirmed as actually being my humble self).
All of this leads me to believe that my phantom account was created as part of some other process - such as when registering a new graphics card in order to redeem a freebie which you then forget about.
So, have Steam accounts ever been silently created as part of some other registration process, perhaps by a partnered company, such as AMD, or am I overthinking this?