ummmm you did not get a message from steam via friends list. that was a fake. hopefully, you did not tell them any of your account information (i.e. your password). If you gave out your password to this person pretending to be from steam over friends, then your account has been compromised.
If this is the case, the password has since been changed and so has the associated e-mail address. That would be why you can’t log into your account or receive the verification code. The perpetrator could have used it to hack on some server.
Don’t wanna sound too harsh, but that sounds like what happened based on your symptoms and “getting a message from steam via friends list saying something really odd about my account.” Try to contact valve to sort this out, but I wouldn’t be hopeful.
Just so you know, nobody from steam will ever contact you via in-game messaging to discuss your account. They have that little warning about it in the message window to explain that and prevent scams like the one you may have fallen victim to.
If you are absolutely sure you did not give out the password to anyone else (especially the guy pretending to be from steam), then I don’t know what’s going on.