Another option would be for users to change their own withdrawal limits (within the range already set up by MtGox), with the limit changes not going into effect for 24 to 48 hours after change, and an e-mail sent out warning about the change. That way, even if the daily withdrawal limit is $1000, I know that I don't ever need to withdraw more than maybe $50 a day and can limit all withdrawals to that, and if I need to withdraw a few $100's, I'm willing to wait a day for that to happen. Make a separate limit on Bitcoin, too. Limiting Bitcoin amount by its USD value can have problems if BTC market price drops.
Im programming a web that will use bitcoins and what I have done is that the out address does not change until 24hours after the change request has been made. So the user sets an out address, and if someone gets hold of his/her password and tries to change the address it wont work for 24 hours. We also send an email to the user if it has set up an email.
this way the user has some time to discover the "hack" and contact us.