Turns out I linked to my activation page (I didn't realize I did until I went back and looked today, I thought I just linked to the bundle itself). The page wasn't claimed by me, so anybody viewing the page could go in, click redeem, sign in to steam, and take the game.
Which is what he did, instead of just fucking asking me to gift him the steam key.