It does look like that some exchanges are still requesting to put some kind of keys into their form to transfer Steem. I am keeping the information as low as possible, but I was able to obtain the private memo keys from 25 different users looking into the data from about 1 1/2 month. There is no hack or similar involved, but these keys have been published (un)knowingly by these users themselves.
I would like to call these users to check their keys, especially their memo keys, as these are now openly available as information on the chain.
Fortunately, a leaked memo key alone is limited in use, but still a leaked private key. The best way would be to change the master key, which would change also the memo key.
Users with leaked private Memo Keys