When you transfer money to MtGox, you're essentially giving it to them. They give you a unique address to send to (so they know who sent the money to them), but after that transaction they have your money. Then, they just update the DB reflecting you have X amount of BTC in your account. As you trade with other people on the market, your respective accounts are updated in the DB. When you want to withdraw, you tell MtGox where to send the money. They check the DB and deduct that amount, and send that money from their big stash of everyone's money.

That is why trades can be instantaneous, and don't require confirmation the network (except when you are sending to or withdrawing from MtGox itself).

In this case, if you could hack the DB and convince MtGox that you had more BTC in your account than you really did, you could still withdraw BTC, but there would no longer be enough BTC for everyone to withdraw.