It seems that the primary target (at least so far) of hacked accounts has been VIP accounts.

At first I was going to argue that the MtGox account was not hacked (it still shows a MtGox email address and it's password was reset via email), however it would be possible that he logged into the account, changed the email address, reset the password via email, then changed the email back.

It is not surprising to see a MtGox account having a weak password