Despite that the legitimate owner of a given amount of ADA in a wallet went loose on keeping hxs account secure, and the saying "No your keys no your ADA", when a bad actor takes ADA not authorized by the ADA owner, the bad actor has to use one of his wallet's receiving addresses. This is an immutable fact that will stay forever in the blockchain.
Using tools like Cardanoscan.io for example, one can trace and watch that wallet to see what other information has on it, * what transactions have occurred, * what is on each transaction, - i.e. NFTs-, to what pool it is delegating to, what have been purchased with that ADA, or if nothing has been done with the ADA, then watch it closely.
Additional Tags: Reputation. Bad-Actor