Penalties for postdoc passing off students' work as his own? What penalties might be imposed for a postdoc taking the work of multiple graduate students (even from other institutions) and passing it off as his own without even providing an acknowledgment of their effort?

I understand that in cases where this is suspected, an email is sent out to the journal editor presenting evidence (e.g., lab notebooks, prior conference presentations, etc.).  

But graduate students don't have much say-power. Even if they provide ample evidence, this is still possibly not enough because of the academic ladder and the seniority of the postdoc/PI involved. I just don't see an editor stepping in for a graduate student(s). It sounds ridiculous. 

At the end of the day, what are the possible penalties/sanctions for such a practice (besides for the proverbially useless and mild "slap on the wrist")?
The sanctions are usually very light. Sanctions depends on institutions' willingness to reprimand the perpetrators.

In the case where this person is copying earlier conference contributions and claiming them as their own, it's a clear case of plagiarism. If the conference contribution is archived in a way, notifying the journal will result in the retraction of the paper. This will hurt the plagiarist's reputation possibly at the cost of a prospective employment opportunity.

In the case where a person "steals work of two graduate students, passes it off as his own" in the absence of publications that shows the work is effectively the students' journals are faced with a "someone's word against someone else's" situation. Often journals defer the responsibility of investigating to the author's institution. This can be a lengthy process with disappointing outcomes for the students.

All of this is off course highly unethical and all reputable journals will want to retract papers if they learn they weren't written by the alleged authors. But it's not illegal per se and "sanctions" range from nothing (the most frequent case) to a few years of publication ban, and in extreme cases: getting fired.

Some reading on the topic:

Arizona prof plagiarizes student’s thesis, gets reprimanded, but keeps her job

Heads up: “Borrowing” your student’s work will earn you a partial retraction — and a five-year publishing ban



If besides being interested in "what are the sanctions" you are wondering what you can do about it, my recommendation would be: 


explore all internal reporting routes: report the behavior to this person's adviser, or to the dean. 
If all fail (i.e. if they do not ask for the authorship record to be straighten) contact the journal's editors. 


In all cases, be prepared to substantiate your claims. You mentioned you have lab notebook, or even conference publications to show that the material is not original. That is good. Don't expect a harsh punishment but at least the papers should be retracted.

(This answer has been adapted to the latest changes in the question)