In the Bitcoin system, "coins" don't exist as such. Rather, there is a central list of transactions and the wallets that own the results of those transactions (the "blockchain"). In a simplified form, "spending" Bitcoin means generating a transaction that says "take this transaction output, which I can prove I own, and transfer ownership of part to wallet X, and part to wallet Y", and having that transaction accepted into the blockchain.
If you lose access to the private key for your wallet, the coins in that wallet are effectively lost forever: the relevant data is still in the blockchain, but without the ability to prove your ownership, nobody has the ability to spend them. Since wallet IDs are not tied to real-life identities, it's also impossible to tell who owns the coins in question.
Mt Gox is renowned for the incompetence of its programming. It's known that a large number of automatically-generated wallets were used for various purposes, and it's quite possible that the missing Bitcoins were transferred to wallets where the private keys were never recorded.
It's also possible that the "missing" Bitcoins never existed in the first place. Mt Gox had none of the internal control and audit systems a reputable financial institution would have, so it's possible that a bug, an outside attack, or even insider shenanigans artificially inflated the apparent balance of Bitcoins held by Mt Gox.
It's reasonably certain that the missing coins are not the result of a double-spend attack. To reliably perform such an attack, the attacker needs to control 50% of the Bitcoin computing power, and nobody has ever managed to accumulate that much.
