We don't know exactly how any scam at MtGox worked, because no one has put out a statement yet. There have been some rumours that MtGox has, through its poor implementation, consistently had problems creating valid transactions, so they lashed together an automated resubmit of any transaction that they thought had failed, thus enabling a massive draining of funds via transaction malleability. This is hearsay.