Yes, an expired domain can have penalties if it was involved in spammy or black hat practices in the past.