This might not be the case for you, but it's worth mentioning because it might be useful for someone else. There is a variant of forum spam that is sometimes referred to as Profile Building Spam. They make about a dozen posts then disappear. The goal is to build backlinks to their profile which is where the link drop appears. Forum software typically creates a link to the member's profile in every post they make. The spam link is in the profile.
...think this could be reason enough for a real harsh Google penalty?
I know of a site that had a software vulnerability exploited for over a year. They were hosting around a million web pages linking to the worst imaginable sites. I discovered it in the course of researching the SERPs and seeing what's ranking and what the quality level was of what was ranking. Did it affect their rankings? No.
I observed this site's rankings for four months to see what happened but nothing negative happened to their SERPs for the phrases I was tracking them on. I estimate they were hosting these pages for over a year based on the date the software indicated for the time the spam was posted and I believe those dates were correct.