Ehm, how we you know that? Maybe the salts were stored another place? Or simply the attacker didn't release them? Or maybe MtGox used a site-wide salt that's stored in their codebase somewhere?

EDIT: Okay, they appear to be unsalted (according to nbpoole): http://news.ycombinator.com/item?id=2671714