They do have two-factor authentication, which the user admittedly didn't opt in to.

See https://support.mtgox.com/entries/21743327-Security