Here is the turn of events in chronological order -

1. The site (in health niche) was hacked by a pharma network, injecting viagra/cialis pages in the site. It was a Wordpress site, and hackers ensured hacked content was only visible to Google, while website remained just as usual to users.

2. Links from this to other similar hacked sites and other sites to this site were built.

3. The site was moved over to Drupal, making a clean switch from Wordpress. Hacking stopped. Lot of time elapsed, since site owner was not aware her site was hacked.

4. Google first issued a penalty for Hacked content and then much later for bad links from other similar hacked sites, while hacked links on other sites were long gone.

5. At this point the site was brought to my notice. From the GWT links report, I disavowed only the links that were hacked from other sites and sent a reconsideration request. The link penalty was revoked.

6. Next sent reconsideration request for hacked content. Which too was revoked.

Take home? Danger is very real for an ordinary site owner that things can take a nasty turn without her knowledge. Fortunately for her, the site had good amount of non-Google traffic which sustained her business in the meanwhile.