Generic moderators work and do countless tasks and most don't even get paid for it. However, on my community one moderator came to me and told be the website's myBB installation was being hacked. Does this mean the "hacker" could find a way to "hack" into a Steam account? All my moderators are, strangely, "worried" about their Steam accounts. And I, As the community manager (CEO/Founder), must found out a simple question; Can this hacker REALLY hack my Moderator's steam account?
The answer to this depends on a few things. Firstly when you say he hacked your myBB forum, did he get into your database? Did he get access to your admin control panel? Did he get a full list of users and e-mail addresses?
If he only managed to deface your site, injected a few thousand posts or something like that, but didn't get access to any private information and didn't hack any admin accounts then you're fine. He's got nothing to go on.
Assuming the worst, that he got everything and that you store users steam account names as additional info against their profile, then to hack their account they need access to the e-mail address that is tied to the steam profile. Lets assume that it's the same e-mail address as used on the myBB forum, as most people will do.
Assuming the user has gotten the full database, hashed passwords and salts, then unfortunately for you myBB only uses MD5 for hashing passwords, which in this day and age is just not enough. Creating a rainbow table to guess common passwords when you know the salt is very simple for a hacker. They'll get most common passwords in a few hours, more complex ones in a few days.
Next they can try those passwords against the e-mail address and steam account. If someone is foolish enough to have used the same password everywhere, then the hacker now has access to everything. If they've used different passwords, well the hacker is still stuck at needing access to their e-mail stage. From then on it's a case of can they hack their e-mail account.
So are the steam accounts at risk? Yes, possibly. Is it likely that the hacker will get in, probably not unless it's an absolute worse case scenario where they got everything and the user was stupid enough to use the exact same, easy to guess password everywhere.