At least it is the same CA, DigiCert (AFAIK). DigiCert has fairly high standards so they probably examined closely when a different org requested an EV cert for that domain. For what that's worth.
Yes, you're probably right, I just recall very clearly that they had emphasized in all of their security warnings to check for the certificate from Tibanne Co, and the current certificate is not.
I don't know how their infrastructure works, but if they use your password to unlock your wallet this could be a phishing attack. Either way, the money is probably as good as gone anyway.
This was what I was thinking, there were the folks who hacked the place and dumped out the data and scribbled on Carpeles log, what better way to get the passwords to peoples wallets then to put up a phish on MtGox's own servers and have anxious users provide it. People log in, give their password, check their wallet and then poof all the coin gets moved out somewhere else. Seems pretty doable if you already have control of their infrastructure.
EDIT: No 2FA, no https, and all data shown has already been stolen by hackers. I'm assuming it's probably real, but still -- be careful.