In one way or another .. the info should be backed up by the user. Steemit can't take on the liability and do password recovery, unfortunately. More warnings/reminders would be good.
In the future, perhaps multi sig with a trusted password recovery partner?