You both agreed on doing it legit and you failed. Putting an account at risk? Sure, to not get it hacked by the user doing a service.
Putting an account at risk? To get it banned because you would do it legit? No.
Either refund what the account was worth or get banned. I know you just said you wouldn't do that, but I want a confirmation.