What if he nolonger has access to PKs of those addresses? Will the negative feedback be maintained?

The fact that he signed from an early pre-hack address and also got the account recovered by the accounts recovery team (those people check even other things like changes in IP address patterns pre and post hack)  should be enough.

I have ever had my account hacked and i didn't even have a staked address and I know how painful the experience was despite my account being a low rank account at that time. We should be easy on him.