u/d3rr I saw this line:

# TODO: refactor to self._spam
if self.is_global_banned:

Accounts already have a _spam property, it's inherited, I think from thing, along with _deleted. Enabling it causes the user to be shadowbanned.

The code for "chucking" an account (password lockout) with the _banned property starts on line 556.

In listingcontroller.py, at line 952, you can see where the profile pages are blocked for _spam, _deleted, and in_timeout. Here's the shadowban one:

# hide spammers profile pages
if vuser._spam and not vuser.banned_profile_visible:
    if (not c.user_is_loggedin or
            not (c.user._id == vuser._id or
                 c.user_is_admin or
                 c.user_is_sponsor and where == "promoted")):
        return self.abort404()