The scammer gets your Steam Web API Key. This can be obtained when you log into a scam website. The next time you make a trade, the scammer (a bot) uses this API key to cancel the trade. The scammer (a bot) sets up another profile that looks exactly like the account you're trying to trade to.
