If Mt. Gox really has been defrauded, then they must be able to present us with one of their outgoing transactions (obviously from before their statements) incorporated in the blockchain where the scriptIn does not follow their normal pattern.

Either extra operations would have been included in the scriptIn, the format of the pubkey would use a different format or the signature would be non-canonical or it's DER representation. I am assuming that they would use an automated did we really pay this script to update their checkbooks, and that it could have been fooled by any of these manipulations.

There would still need to be some party involved in changing this part of the transaction (wittingly or not) and some client with a Mt. Gox account making use of the changed transaction to later seduce Mt. Gox into paying twice.