I am sorry to hear this Neo. I for one think that Steemit Inc is the one to blame here for erroneously intervening in the account recovery process.

They are only allowed to activate the recovery process if the account is "compromised" to which it is not, since he gave you the key himself in his own volition in exchange for 45 Steem to which can be checked in the blockchain as you've said.

They obviously didn't check much the account's transaction and transfers as they would have seen your 45 liquid Steem transfer which was immediately transferred to another account seconds after. That itself is already suspicious and should have been a red flag for Steemit Inc to make more background checks before starting the recovery process.

You should probably add next time in your loan contracts, in addition to the "I agree with this contract", a memo transfer to you stating they agree with the contract with the url of the said loan contract. Since that cannot be edited out and is easily viewable in public (I don't think Steemit Inc will check every accounts comment/edit history)