The big problem is that this person isn't yet banned from Hexbear if they're able to see and downvote our posts.
They might very well be banned. The downvotes are being seen from lemmy.ml. Bans basically function as a shadow ban - the user can still see and interact with the copy of the "content as seen through lemmy.ml", but their comments and votes aren't federated back to Hexbear.