They should refund the people who fell for the scam. It was their responsibility to keep their mail servers safe, they failed to do so, and resulted in a monetary loss of their customers.
Besides, the amounts lost were completely trivial in the grand scheme of things so it would be good PR for them to do it. Not that it is their duty to do it, but acknowledging the situation and reimbursing losses instead of just glancing over the issue is much more sensible. Ofc, certain protocol would need to be followed to ensure that the perpetrators themselves are not taking advantage of the situtaion.
But yeah, I've never seen any gambling site directly ask for funds through an email in return for more money. If you receive such a notice, it is 100% a scam.
Yes they should keep their mail servers secure but it's really not the hack that caused the loss... people who sent money to those scammers probably would fall for any forged e-mail. The hack maybe made it easier to target specific users but phishing/scamming e-mails are nothing new, people should really know better by now. Is it even possible to determine who sent those funds? Could be scammers themselves trying to making it look like it's a legit offer.