I don't see how this is up for debate as an issue really, at least to me Steam is perfectly in the right in doing this, it kinda sucks for the people who basically had their money stolen, but I wouldn't want to be mugged in the street either. Think of it like this to make it more personal:
You have a fancy watch, and your watch gets stolen. A day later the guy who stole your watch sells it to someone who doesn't know it's stolen, and pays $100 for it. Eventually everything is sorted out and the watch is found to be stolen, now:
1) Should the third person keep the watch they bought? No, it was your watch and it is still your property, the second person had no right to be selling it.
2) Should you pay the third man back for taking back your watch? No, why should you have to pay for the second person's crime?
3) Should the third person be compensated? Yes, the third person should be compensated, but not by the victim of the crime. If the second person is caught, he will be the one returning the money to the third party.
After all, if the first person, or steam in this case, had to pay back the cost of the product stolen from them, then the original crime might as well have still happened, they would still be losing the same amount of money equivalent, so that in no way fixes the problem of the original crime. And dealing with digital goods doesn't change anything in this case.