diberry - 6:08 pm on Nov 13, 2012 (gmt 0)
Sidebar links on blogs have definitely been viewed as link schemes by Google in some cases. This is one of those unfortunate cases where Google sometimes assumes manipulation where it may or may not have been intended. I don't know whether this alone would have gotten you in trouble, however the hidden text dude's actions combined with the sidebar links may have pushed Google to assume you were all up to no good.
And to answer your basic question: it depends what you mean by "legitimate", but getting hit by Penguin doesn't mean there's anything wrong with your site, per se. It means Google thinks you're using dodgy SEO methods to manipulate rankings. Unfortunately, this can sometimes happen without the webmaster having any intentions of manipulating ranking. Competitors can set up tons of links to you that it looks like you set up yourself, for example (it's called negative SEO). Or something like your hidden text guy combined with the sidebar links can push Google's assessment over the edge.
I hope disavow works for you! Sounds like exactly the situation it was made for. But Robert Charlton is right - save the explanations for a reinclusion request, not your disavow file. They'll want to know what you did to remove those links, and there you can explain that you had no control over them in the first place.