OP, can you ask MtGox to check and confirm:

a) that funds can only be withdrawn from your account when the yubikey is used.
b) that their logs show a 3-sec (long-press) was actually performed on this withdrawal.