No, you're missing the point. Mt. Gox is not publishing the transactions that occur inside their exchange to the blockchain; they are tracking them themselves. All the bitcoins deposited at Mt. Gox are in one big wallet. Only when a user deposits or withdraws coins does a transaction get posted to the blockchain. (I'm not 100% sure of this, admittedly, but I've seen no evidence to the contrary and lots of indirect evidence that supports it.)

So what could happen, as the result of bugs in their code, or of an attack, or (hypothetically) of deliberate fraud on their part, is that the total BTC balance of all account holders could become greater than the total BTC they have in their wallet. As the above posters noted, this would have the effect of creating BTC; no one outside the exchange would be able to tell that it had occurred until someone tried to withdraw their BTC and found it wasn't there.

Now what they could do is make a separate wallet for each user and post all trades to the blockchain. This would perhaps be more in the spirit of Bitcoin as it would prevent the totals from getting out of whack. But as I say, I'm pretty sure they're not doing that -- for one thing, if they were, rolling back trades, as they have recently done, would be impossible. (And although I was not involved in this 500k selloff, on either side, I think they have to roll it back to preserve any hope of Bitcoin being taken seriously.)