Even if the VPN were locked down and no trace of your IP were leaking, this doesn't mean you can commit nefarious acts online without getting found out. There are log files on every server. The amount of time logs are kept varies. With enough resources and legal action, log files from VPNs could be turned over to authorities. Once they see your real IP, they simply subpoena your ISP and will find out who you are. Realize that it can be more complicated than the scenario I use above, but my example is to simply help you understand that you're not truly hidden online.
However, a few websites have cracked down this problem but it's not revealed exactly on how they did such a thing.