Said hacker did not hack the accounts. Not wittingly.

Depends on whether you're looking at the short-run or the long-run. Agree with parent that, in the short run, extreme punishment destroys value. But any punishment has a deterrent effect in the future: when John Q CEO evaluates the gains from cheating against the expected punishment, the larger that punishment, the lower the likelihood that cheating occurs. How you evaluate the long- vs. short-run implications of punishment is tricky, but if one cares at all about the long-run, one would probably want to increase the punishment over what constitutes reasonable reparations.