Hello, since you mentioned in your description that you did log in. I highly suggest you to do the following as you might have been hijacked.
1. Change password immediately, and also change it anywhere else you have the same password set. The scammer will try to log into your email with it when he loses access.
2. De-authorize all other devices here: https://store.steampowered.com/twofactor/manage
3. Revoke any API keys set. Their only use, if you don't know what it is, is keeping control of your account. https://steamcommunity.com/dev/apikey
Once you have done all that, please reply here so we can continue with the report.