I reported a guy for ninja looting and got a reply from a GM that he was gonna get a ban, but I've been inspecting his armory for the past days and he still has the item he ninja looted. So I guess if you really want something you can just ninja loot it and take the ban while playing an alt account or something. (?)
I was not aware that ninjas get to keep the items they ninjad, that's crazy, with that being said it's definitely worth it I am looking forward to getting BIS'd out soon lmaooo.
Ya it isn't awful on Onyxia where it's mostly just phase 1 loot in dungeons with pugs and a single item.
On Icecrown though you'll have pug raid leaders doing ICC 25 8/12 HC where they hold all the loot till the end then they disconnect after LK is dead. Then they change their character name. That's very high risk, but very high reward. I think bans for higher level content like that is more severe. I've seen it several times though. Most computers have a game record option nowadays so best to make that a habit for those situations. It sucks though because you put in the effort and even if you catch the ninja you don't get anything. You lose the loot and they keep it.