If I understand well, a poor protocol implementation could cause MtGox internal system to re-send more than once certain transactions due to the malleability issue.
If this happened, the bitcoins are not lost... somebody (that could be also MtGox BTW) who was "attacking" the protocol by creating the transactions with a different id is the owner of the bitcoins leaked by mtgox.

I guess that it should not be very hard to find duplicates in outgoing transactions with the same amount.

If my assumptions are right then this implies the following:

MtGox is lying when they say that the bitcoins are lost due to a flaw the bitcoin protocol. The bitcoins were stollen from the exchange due to a poor implementation.

On the other hand, it could happen that they had a faulty internal exchange software making disappear bitcoins (destroying the only copy of private keys containing bitcoins). I really cannot believe that this happened. And this will be impossible to prove. They could have stolen all the bitcoins and then say that they lost the private keys.

Too many mistakes/bugs are necessary to loose bitcoins for ever. My personal opinion is that they have stolen the bitcoins and they did shutdown the system to avoid users to recover their transaction ids. Without this is almost impossible to track all the bitcoins that went in/out from MtGox.