A few thoughts. I agree with you, which is why we are currently going through a third party security audit in addition to the impromptu peer review by Andreas the day MtGox went down and our normal reviews by accountants. We also hired a director of security from FB. Also, there were rate limits, just not well tuned enough. So it's definitely in focus for us.
There are still a few lingering issues, which we've been working hard to fix and will be looking at again today. To those affected, I'm very sorry for the wait. Funds are safe, it's just a question of opening the pipes properly to let them flow normally.
This design looks strangely familiar... :)