I haven't been sandboxed by Google because I had some whitehat link building going on at the same time, but my SERPS have dropped after some xrumer runs. This is mainly because the IP address the dude used to post my comments was marked as spam in stuff like the "Project Honeypot" project. It sucks. So, my advice is to do a little of both, so google gives you the benefit of the doubt.