I'm assuming you're asking how do we, the staff, know when to ban an account for it being compromised. Generally speaking there ways (some easier than others) where it becomes evident an account has been stolen.

I can't get into specifics with you as I'd hate to release private information about our powers as smods/admins, etc. but just know we use many different technical tools along with the easy and available conventions that normal have access to (like transaction history). If at any point something looks suspicious, usually it's reported by the user who's account is stolen or from a deal gone bad (scamming), we permanently ban an account and launch an investigation.

Example: "Hey, I just paid $50 for TC from Taco, and Taco isn't giving me TC.", we then go look up Taco and we have "reasons to assume someone else logged in as Taco", we can permanently ban Taco's account, launch an investigation, and see if we can get ahold of the real taco. Then we do our best to of course address the scam executed while the account was compromised.