3. it seems like the gox omnibus acct should net out even at the end of the day. double deliveries would raise red flags (one would think) when all has been netted
You assume MtGox is doing daily reconciliation. Given all the other things they either didn't do, or did wrong why would you assume that. It is entirely possible they had absolutely no check's and balances in place and the same attacker "double withdrew" dozens or maybe even hundreds of times. The issue with MtGox generated bad withdraws has been going on for a month.