I'm not sure how true this is but it kind of makes sense.
I had some e mail correspondence recently with someone in the USA (who knows more than me).
He suggested that the best thing to do in any situation like this (he called it Yo-yo-ing) was absolutely nothing. He said temporary movements were normal and he suspected that there was a filter that looked for unusual movement after a fall.
In other words, if a site fell in the rankings, then suddenly got a load of links pointing at it, it was a sure sign that someone was doing SEO to recover the previous position. This could trigger a penalty.
If nothing happened, it looked natural and the site would be restored.
As I said, I have not seen any proof but it's an interesting thought.