People keep saying that rollbacks are "usual" on securities exchanges in case of massive mistrade.
This is true indeed.
But I'd like to remind everyone that such rollbacks are always overlooked by the SEC / FSA / other regulatory body to whom full disclosure is made.
It is also common that the identity of the main beneficiary of the rollback is disclosed publicly for the sake of transparency.

In the case of MtGox, who is the regulator?
Who will warrant that the rollback is legitimate and fair?
Who will verify that the flash crash is due to an intruder, and not a fat finger.
Who will confirm that MtGox does not have vested interests in this rollback?
Who will make sure that the "victim" of the mistrade was not himself doing market manipulation / predatory trading under cover of the MtGox darkpool facility (USD 8M on a single account is very suspicious).

As an exchange, MtGox has a duty of transparency and equity.
This affair must be reported and audited by the SEC or JSDA asap, and the involved counterparts should be notified of it.
Alternatively, full public disclosure of the identity of the beneficiary account is the least that MtGox can do if it wants to proceed with the rollback anyway.

MtGox, please be aware that not only you can refer this matter to the regulatory authorities.
That'll surely look much better for you if you are the one who does though.