is there a penalty for them or is it permissible?
if they are proven to do this. what if their rank is lowered too?
Yes, that is abusing merit the receiver and sender merit will be punished once they are caught someone and proven they are abusing both accounts were got negative trust.
What is lowered rank you mean? Only neg tag they've got.
You can report here if you found suspected merit abuse.
https://bitcointalk.org/index.php?topic=2896910.0