The issue isn't really that difficult to solve, it's just that their software was doing accounting badly and losing track of what was spent where when the malfo

The issue isn't really that difficult to solve, it's just that their software was doing accounting badly and losing track of what was spent where when the malformed transaction was spent rather than the one they believed they created. An attacker can rely on this (the transaction ID from their perspective never confirmed) and ask them to resend the funds. The attacker doubles their money and suddenly Gox has outputs they think aren't spent, but really have been in a transaction ID they don't know is their own. When they roll these "unspent" outputs into new transactions they fail to broadcast, and then we are in the situation we are in today with a number of backlogged transactions. Fortunately for them if any money has been stolen using this, they probably have the ID of the person in question. Your system would work as a hack, but for somebody as big as Gox they would have a significant impact on the blockchain size for no good reason.