[gojomo]

I don't know of a comprehensive survey of all kinds of malleability evidenced in the blockchain. It should be possible.

The issue with using it to estimate an upper bound on potential MtGox losses is that since some portion of MtGox's historic transactions were non-canonical, a third-party mutation could result in a 'normal' transaction entering the blockchain... but MtGox still confused, perhaps to the point of loss. Any survey would miss such transactions.

Maybe there's a private archive of never-confirmed transactions. Since it seems MtGox at times provided a public feed of (some of?) its own intended transactions, someone who'd been scraping/saving that for long enough might have a useful estimator dataset.