Would it not be possible to track the stolen coins and find out what exchange and account was used to sell them?
Probably, if both exchanges cooperate. But if the thieves used Tumblers, it would be damn hard.
If they used malleability to withdraw coins from gox double, they should be verified with gox themselves anyways. If they didn't use fake ids that is..
Yeah, that's what I've been thinking. After magicaltux has fixed his shit, he should have these guys with negative balances in the system.