Well it's very legit that they can refuse it to pay (repay) saying that it's lenders fault because they did not do their due diligence properly.
This doesn't look like a good way to go around, as an account is itself an identity here, and all this comes down to the account owners fault in not able to protect his account.
Would it be wrong to leave a negative trust feedback afterwards, now that negative trust doesn't mean that someone is a scammer? The text says:
You think that trading with this person is high-risk.
I don't think it's unreasonable to believe that trading with kenzawak is high risk given that they were hacked twice in a short period of time and refused to take any responsibility the first time (and clearly didn't seem to improve their opsec either)
I don't think one should exclude him because of this incident or give him a negative trust, because as my personal text suggests, its already not that safe online and anybody could get a victim of such attacks unknowingly, it doesn't make one a high risk to trade with really IMO.