It is if you investigate it. I would analogize it to intentionally depositing money in the wrong bank account -- if some company keeps sending them money over and over addressed to the wrong account, at some point the bank has to draw the line. It's not fair to expect them to continue debiting the accounts of innocent customers incorrectly credited by someone else's mistake. It's not unreasonable for them to say that they'll credit the accounts the depositor asks them to credit rather than having to constantly tell innocent customers that their balance is wrong.
You would be surprised how this turns out when the responsible party is an actual bank
http://www.calbankers.com/compliance-bulletin/bank-held-liable-wire-transfer-losses-phishing-scamOf course MtGox is not one. If it were one, it would be required to either refund all of them, or put barriers in place