he made me promise not to say his account username so i won't, and anyway it is only about 60 btc so it is no big deal.
basically he has a very common mt gox account name, something like "simpson" (but it is not simpson!). when the hacking episode happened my friend wasn't too worried because he only had a couple of btc and a couple of u.s. dollars in his account.
when mt gox reopened he checked his account balance and was surprised to find it says it had about 65 btc and $200 in his account.
he said nothing, and as soon as mt gox allowed withdrawal he tried to withdraw all btc to his own address, and successfully got them.
he says he is waiting mt gox to start trading, then buy btc with all $200 and then transfer them out to his own address, then abandon the account and start another one with mt gox for his own proper trading.
i agree with him this is not theft, as it is just some extra money from mt gox mismanagement, like that guy in nyc walking around the diamond district and picking up gold coins.