I never used gox so I dont know the specifics, maybe others can shed some light.

Was the $1000 valuation of BTC maximum's withdrawal based on the pinpoint price, a 24-hr average, a 48-hr average, what?

If it was pinpoint, it sure explains the ENORMOUS amount of coins transferred in the blockexplorer reports as the attack was occurring.... The guy may have gotten away with 100,000 btc.