Steam account - Query account by CD key

That usually means that one of the people you won from managed to post the same key again, and the new winner tried to use the key query function that automatically sends out an email to the account owner whose library has the key used. It is not worthy of any concern. Account takeover by showing a key as proof is a lot more complex than that.

Somebody just tried to use the key activated on your account. There is nothing to worry about. Just ignore the mail, as stated in it.

If you activated a steam key that was posted publically, it's probably somebody else trying the same key and clicking the button to be stupid. Or sometimes game giveaway sites give out duplicate codes because they are programmed horribly.

The "worst-case scenario" is that somebody hacked into your account at some bundle site or key seller site and is trying the keys you have on your account to see if any are not yet used.

But it's probably the scenario I mentioned in the first paragraph, in which case you have nothing to worry about.