The key to security is time.

This is a good point. The one exchange that hasn't really had problems is BTC-E, which is also the oldest. And that is because they automatically freeze an account for 2 days when you attempt to change passwords or emails. And that has been sufficient time for people discover they've been compromised and contact support to retrieve their accounts. I don't know why other exchanges don't follow the same practice when it is clearly so protective and beneficial.