Was there really any need banning the account when the funds are no longer there?
I personally feel that Stake should have left the account open and accessible to the hacker who created it, we never can tell, a thing or two might happen which might lead him into trying to use that account again, and from there, he can be traced, as long as he is not using a VPN, But unfortunately, it's already too late.
But still on still, I don't know what importance the ip address the hacker used to access Stake, would do, I would have suggested you try to get the IP address used to access that new stake account from, if this can help to track and catch whoever is responsible.
-At least that will give OP a fair judgement and make the hacker a loser even though he made away with a good some from that stolen account.