Here we have a mtgox user who got owned due to a process on mtgox that made it easy for the attacker
to do so via a password reset while having access to the user's email account.
It strikes me as very beneficial for mtgox to close this hole.
The "hole" happens to be standard security procedure for every site on the internet... even banks.
If you lose control of it there is nothing a site can reasonably be expected to do.