This was someone on a vulnerable OS, running without malware protection, with Java active in the browser, visiting an unknown link, and possibly giving an application permission to run. (Although maybe it didn't need permission to run?)
To get to that point the person needed to ignore several well established security principles.
Sure, the user was being stupid here, but MtGox didn't do them any favors either.
Not hard, and they did it a long time ago. The user didn't opt in.
On top of that the user
1) Chose to turn off (or not use) malware software
2) Enabled Java in the browser
3) Chose to visit a short url link presented in a chat window
4) Clicked through a big scary warning
All while still logged into their MtGox account.
It sucks that they're a victim of crime, but their actions were dumb.
I'm not familiar with Mt Gox but it's unacceptable if they don't have two factor authentication.
EDIT: Scrolling down, it appears they DO offer two-factor authentication. nvm.