Transactions are malleable. Deal with it. If a transaction is observed on the network that has the same input outpoints and the same outputs, it is the same transaction, and mtgox should treat it as such. This is a simple check to do, and trivial to automate.
The trivial fix it to use the hash which is used for signing as a transaction identifier. Should be fine for all standard transactions.
that would not spot modifications e.g. through removing/altering an unused push from script.
The simple solution is to know what coins (UTXO) one owns and recognize if they are spend no matter with what hash.