In an answer on Meta Stack Overflow, Brad Larson ♦ mentions,
In the vast majority of cases where the 100-point penalty is applied and a moderator notices, the account is also destroyed....
The few outlier cases tend to be when you have an otherwise good account that all of a sudden posts something bizarre. Sometimes it's a compromised account, sometimes people leave themselves logged in at a shared computer, etc.
In the cases where a contributing user does get hacked, and the hacker starts making red-flaggable posts (e.g. Spam, nonsense, or personal attacks), is there a procedure for separating out the penalties due to the hacker and negligence penalties applicable to the original account owner once the owner regains control? That is, if someone hacks my account and spams with it, am I "stuck" with the applicable black marks against my account (-100 rep penalty for each post, suspensions, question bans, etc.), or is it normal or expected for such posts to be disassociated or at least have applicable penalties reversed? For example,
I have disassociated the three Spam posts that the hacker made with your account, which will refund the 300 rep you lost as a result and lift your question ban. Unfortunately, it seems that you are not entirely innocent because you left your account logged in at a public library where the spammer found and took advantage of it, so I am Suspending you for a week so you can spend some time thinking about best practices in information security. Come back in a week to continue contributing.
At first I thought that it would be normal, natural, and just for all penalties to be reversed against the hacking victim upon submission of proof of victimhood, but then I remembered that I have dealt with some organizations other than Stack Exchange that have had Terms of Service clauses that more or less said "You agree to keep your login credentials secure and will be held solely responsible for any actions taken using your account", but I haven't been able to find such as clause for this network.