So Bitfinex, pretty similar volume to Bitstamp, reports about 200m in volume in the past 30 days. A run rate of 2.4b.
Their fees are roughly 0.4% on a transaction. But note, the fees are incurred twice per unit of volume. i.e. they pair a buyer and a seller, who both pay a fee, thus you get a 0.8% fee on any unit of volume.
So we end up with a very rough revenue of $20m a year. Of course there will be various costs, but I've seen most exchanges run with teams of 6 core people, with another 6 or so support staff. I wouldn't expect to see much larger teams than 20 at Bitstamp, and given their cost-center for development is in Slovenia, I doubt you'll see them average more than $150k, which would be $3m per year.
So, together with $10m in funding not so long ago, together with substantial revenues ($10-20m per year), and together with the fact it's quite likely we're talking about early adopters (Company was founded in 2011, the year of 30 cent bitcoins, 1000x cheaper) who likely could pay this out of their own pockets, do they have what it takes to cover $5m? I think so. On that last point, if they had $5k of bitcoin when they founded the company, that'd be worth $5m today, and over $15m a year ago, for perspective. It's not at all unlikely they're sitting on $30m, but rather build a company where they offload their entire risk and give up 30% of equity. Who knows.
Does that mean an audit isn't necessary, not at all. It should be standard practice. Just speculating here on whether I think an audit would show a positive result or not, I think it would.