They absolutely can. In late 2011, one of the graphics card manufacturers did a promotion where they bundled Steam keys for Dirt 3 (which was a $60 game at the time) with their cards. The exact delivery system involved something like entering a code from a piece of paper inside the card box into a thing on the manufacturer's site, which would then spit out a Steam key.
Somewhere along the line, someone figured out that you could access a directory on the manufacturer's website that had a single .txt file with all of the keys (several thousand of them) listed inside. The list circulated around the internet, and as a result a whole bunch of people got the game for free. The manufacturer found out a few days later what had happened and went to Valve, who immediately began revoking the game from people's accounts. I don't know how far they actually got, since a couple of people I know who did it still have the game on their accounts today - though I think that might be because they figured out that some of the keys had been used by people who had actually bought the videocard and were now confused as to why access to their game had suddenly been revoked.
The problem for Valve is that it's really hard to make a working policy on this sort of thing. Years ago, they used to lock or ban accounts for receiving gifted games that came from a stolen credit card or if the card used to make the purchase had been issued a chargeback. The problem there became that you'd have people banned for no reason other than that they accepted a gift from someone who later had their credit card stolen or had the charge disputed for some other reason. I can recall at least one instance where someone got banned trying to get around the censorship restrictions in Germany by having someone from the US buy them a US copy of the game.. only to find out that the person in the US was a minor using their parent's credit card and that the parent disputed the charge, resulting in a ban. They've since changed their policy slightly (in that they'll usually only ban the person who made the actual transaction and not the person who received the gift) but it's still imperfect.
At the same time, Valve also had the same issues with Team Fortress 2 and Counterstrike: GO. There were numerous reported cases of Russian or Chinese credit card thieves using stolen credit cards to make in-game purchases (usually "keys" to unlock potentially valuable items) which they would then trade to an unsuspecting victim knowing that Valve was reluctant to delete in-game items once they'd been traded. The scammer would then take whatever they'd gotten in trade and sell it at a fraction of market value. There was one notable Russian scammer who was moving several thousand dollars in TF2 items a week this way. Valve's response to this was to introduce one of the most user-hostile systems ever invented: you either attach a phone number to your Steam account or become almost unable to trade with 20+ day waiting periods involved.