And even if they didn't notice it right away. It takes a lot of effort to race an unconfirmed transaction and let the coins get respend (double the actual withdraw in your address). Especially when mtgox let's you verify your account with your official documentation. Additionally with the fees generated just today they would cover 500 Bitcoins in losses just from one day revenue.

Unlikely. They should have noticed that they had to do some transactions repeatedly, probably after being contacted by people who exploited the "flaw". This doesn't scale well.