I have a suggestion, and that is in glizer, the verified owner of a minecraft account, can in profile, populate a "only authorized" IP list.
All servers running the glizer plugin will then kick the player if he joins from "incorrect" IP.
The IP-list could accept the format 0-254.0-254.0-254.0-254/16-32
which would allow up to a B class network to be specified, and the IP list could for example hold a maximum of 10 IPs. IPs specified without /16-32 addition, would then be assumed to be /32.
Also the glizer website could prevent players from logging in from "incorrect" IPs, and only way to reset this is to request a password reset via email, this will also empty the IP-list and allow connections to both glizer-running MC servers & glizer website from any IP.
Thus, only way to hack a account protected by IP-security/anti-hack would be to gain access to the account owner's email account.
This would greatly reduce the attack surface for all minecraft accounts registred on glizer, since even if a user would specify his whole ISP B-class network because dynamic IP, a hacker would need to sit on the same ISP to be able to hack the account.
This could prevent people from being banned globally because they get hacked. Then hackers who hacks other person's minecraft accounts would not be able to join any glizer protected servers, because the account owner has specifically noted that this account is only permitted from these IPs.