Wow, best thing for Tom to do now is step in the open (list all used addresses on MyBitcoin, so that things can be traced (if someone sells stolen bitcoins MtGoox/Tradehill or other exchanges might track the thief down)) and start communicating with people, that will give him some credit.

Second, he stated once that most of the bitcoins were stored off-site. How can they be gone as well?

It is all up to Tom to get his credit back and I think that there are enough people who would be willing to help him with that. If he was a real scammer we wouldn't hear anything from him back.

I see a lot of similarities with the MtGox hack, they got out of it stronger. This should be possible for MyBitcoin as well.