1. A method implemented at a computer system that includes one or more processors, for risk assessment, the method comprising: evaluating historical authentication data to identify a set of authentication context properties associated with user authentication sessions; evaluating compromised user account data to identify a set of malicious account context properties associated with at least one of compromised user accounts or compromised user authentication events; annotating the set of authentication context properties and the set of malicious account context properties to create an annotated context properties training set that includes at least two of a user browsing history property, a geolocation property, a target service accessed by a compromised user, a social network profile property, an application execution context property, a client device property, a device interaction property, an authentication challenge history property, a user contact list property, or a user activity property; training a plurality of risk assessment machine learning modules based upon the annotated context properties training set to generate a plurality of risk assessment models, wherein each risk assessment model is responsive to a predefined context property; identifying a current user account event of a current user; evaluating a first current user context property of the current user using a first risk assessment model; based on a first result from the first risk assessment model, evaluating a second current user context property of the current user using a second risk assessment model; aggregating results from the first and the second risk assessment models to generate a risk analysis metric; moderating the current user account event based upon the risk analysis metric; applying the aggregated results from the first and the second risk assessment models to prior user account events of a user to generate an evaluation metric; and retroactively banning or unbanning the current user account based upon the evaluation metric.