Is there a way to validate, that the account is not hacked and provide a growing power down option ?
Yes, getting hacked usually means key changes occur. If hacker gains control of your keys he will use them to change the keys so you can't cancel a powerdown with the same keys. So you could say if no key change has occurred in 1 month you could allow people to unstake faster.
Recovery only works with hacked accounts, it won't work if you've lost your keys. You still need the original keys to change them back to a new set of keys within 30 days while being in contact with your recovery account trustee.