if mtgox know this cant they just require a password change by everyone...

pretty simple fix isnt it?