These may be trades executed with the API:
https://en.bitcoin.it/wiki/MtGox/API/StreamingOne should investigate if API trades do not show a login, and if they don't, then that is likely the method used.
It is very possible that someone found a way to exploit persistent data, cookies, or some other way that a users session or identity can be hijacked in the MtGox interface.
Marcus from Mt Gox have responded back saying they are not able to differentiate whether trades are executed via API or not. Given there were 2600 transactions on my account over a mere 30 mins, I cannot see that being executed manually.
I have also asked for login logs for my own account (without saying whether I need to see IP addresses or not), and have been declined due to their privacy policy.
I'm seeking further clarification on exactly which part of the privacy policy is he referring to.