I don't know how their infrastructure works, but if they use your password to unlock your wallet this could be a phishing attack. Either way, the money is probably as good as gone anyway.
This was what I was thinking, there were the folks who hacked the place and dumped out the data and scribbled on Carpeles log, what better way to get the passwords to peoples wallets then to put up a phish on MtGox's own servers and have anxious users provide it. People log in, give their password, check their wallet and then poof all the coin gets moved out somewhere else. Seems pretty doable if you already have control of their infrastructure.
