In IOTA you should never re-use an address for outgoing value transactions because part of the private key is 'revealed'.
But if the bundleHash is normalized, thus avoiding the M bug, than the signatureFragment will never reveal part of the private key, see page 8 and 9 of https://www.mobilefish.com/download/iota/create_and_validate_signature_part17.pdf
My question is: How is the private key revealed if the bundleHash is normalized?
Your private key consists of a series of "chunks". The public key is generated by hashing each chunk 27 times.
So, 27 times hashed is considered public.
Every chunk that is hashed less than 27 times means that it reveals your private key partially (although it does not reveal any of the original trits of the private key).
For example, consider you reveal how your first chunk looks after hashing it 7 times. An attacker will be able to use this information to sign any messages where he has to reveal how the chunk looks after hashing 7 times, but also if he has to reveal it after hashing 8, 9, 10, ..., 27 times (He can continue the hashing). If a message requires to reveal how the chunk loooks after hashing 5 times, he is lost.
When signing only a single message, the normalization makes sure that for every other message, at least one chunk has to be hashed fewer times than the revealed one. So signing a single message is safe. But as soon as you sign two messages, it can be that an attacker can sign every other message, too (as an extreme case, consider a normalized hash where half of the chunks get hashed once and the other half gets hashed 27 times (and the chunks are different).
So the attacker knows how every chunk hashed once looks like, and since the normalized hash never contains a M, he can sign every other message (by continuously hashing the chunks).
