Well what was for long theoretical possible to program is ongoing now for some month in reality. However I unfortunately heard just yesterday about this 1st time from NNJ.
There are now indeed servers out there which are reading and storing your CoD4 CD-Keys.
One server which is doing this we are aware of is:
91.121.21.210:28968 - 3xp' 24/7 Nuketown TDM/SD
There maybe even more out there we don't know it.
Well I recommend to stay away from any server with the IP: 91.121.21.210 or "3xP" inside the name.
Also it is recommend to stay away from any server you don't trust when the following 2 conditions are met:
#1 It downloads any content to your PC
#2 You have a valid and legally bought CD-KEY entered in CoD4.
You can enforce such a policy by entering into console \cl_allowdownload 0
Or if you don't like console go from Main-Menu to: Options -> Multiplayer Options -> Allow Downloading
You have to do this whenever you join an untrusted server as this can got reset by any server.
How can I detect a cdkey stealing server ?
You can detect it on this way (However when you have detected it, it is already too late):
Whenever you have not opened the cdkey-dialog by self before but after you have joined a server the cvars cdkey1 - cdkey5
are set you have joined a server which did at least read your CD-KEY. You can check this by opening console and type only into it "cdkey". "cdkey1" - "cdkey5" will show up here.
So be careful now until there is a fix available.
Looks like they are doing it since August 2013 so it had happened for quite a long time already. (See attachment)
Adding evidence...
Extract the modfolder and play the demo inside the modfolder. If you are done with demo cdkey1 - cdkey5 will be set. This demo got recorded on this 3xP server of course.
Playing this demo won't expose your CDKEY to anyone if you quit your game after you have played the demo.