The behavior I saw with NSA articles is they were already penalized by the time they hit the front page, while other articles were up for minutes or so before getting penalized. This implies (but of course doesn't prove) the penalty is automatically applied, not the result of flagging. (And I mention flagging three times in the article.) Also, there is code in the published source to automatically penalize articles based on "rallying cry" words in the title. It's possible people are flagging NSA articles right off the "new" page, but it really looks like they are getting automatically penalized.
Edit: Several people said I should have said more in the article about flagging. There's no way to distinguish between penalties applied by administrators and penalties due to flagging. So there's not much I can say.