The site never tried to buy links and it was run 100% 'white-hat.' There are many (I'd say about 100-150) of natural and on-topic links (the site is pretty much focused on one defined theme) and until recently it was enough for the site to rank well in Google. For example, I read threads about Penguin, Panda, and other penalties but it was only theory to me because the site was never affected.
The non-profit will be fine even though it lost a substantial amount of traffic and I lost confidence in what I know and don't know. It also made me paranoid about things I should not be paranoid (for example, when I check statistics I see some strange domains listed as a source of traffic; I guess I'll have to copy-paste them and disavow over and over again). I would have hoped the technology is sophisticated enough to take care of such things automatically.
Anyway, I'm hopeful Google will resolve it. Still, I'm afraid Google will 'mark' the site as 'suspicious' and it would take a lot of time for rankings to go back. That would not be good news to anyone but the people involved in black-hat / negative SEO.