40 years in prison is way out of proportion, guilty or not. Are there black hats in the US currently serving this kind of sentences?
But if he wrote the trojan and if a lot of people had their life turned upside down (identity theft and credit report issues aren't fun) I don't see why he shouldn't go to jail, for quite a while.