This was sent to me by "Automated Message System":

Greetings Steam User,
This is the Automated Message System by SteamPowered™, contacting about Case #8469204. For the last week we have been monitoring your account closely. We have detected up to four (4) different IPs logging into your account, this may be because your account has been compromised or simply because your IP has changed, here at SteamPowered™ we just want to be sure that your account has not been stolen. Please enter your username and password in the following format: username/password. If successful, $20 will be added to your steam account to compensate for your inconveniences. If entered username and password does not match our database, this account will be frozen and the case will be opened. Thank you for your time.

He then went offline several hours later. And he thought ahead enough to make his profile private. I can understand why someone might fall for it, but they'd have to be pretty naive. :/

Also, how/where do I report this in Steam?

I give it a 7 out of 10.

While he's certainly got the decent grammar and business document attitude down, the whole thing is poorly designed to the point where he's going to get his stupid ass banned. The 'Case #blahblahblah' really threw the whole thing down the toilet. He can't even stay online to answer questions regarding his 'services'.

While better then most scammers I've seen, it's still mediocre.

http://That_guy.justgotowned.com
'Nuff said.

I completely agree with both of you.

He's mediocre. Thing is, the case number was fine, albeit a bit too high. What threw it was that it wasn't watertight. For one, it was a steam user. That gave it away right there. He would have been more successful using an email close to a Steam one, or trying to "trade" games with someone.