You have nothing to worry about ASSUMING your email account is secure. If I were to change any password, it'd be my email password not the Steam password. That way and device (like, say, your "friend"s computer you accidentally stayed logged in to will be logged out so his "neat prank" of locking you out of Steam won't work).
Some websites (I doubt steam is among them) will display a message when you try to recover your password saying something like "A message was sent to blah@foo.com with instructions on how to recover your password". With this the attacker (probably a bot) now has your email address and adds it to a spam mail list. Or if it's an attacker, they may try to brute-force your email account through the recovery options (guessing the answer to those security questions are so easy thanks to Facebook

). Like I said, I doubt Steam states the email address the recovery email was sent to, so this more than likely isn't a problem (cannot verify since I don't use steam).