A third Palestinian Arab is being questioned by Dubai authorities for his involvement in the murder.
Two (or three) of the suspects left Dubai after a reconnaisance mission (or the hit) and went to Iran.
Iran is the only player in the region outside the Mossad that would have the means to do such an operation, and the ability to make it look like Israel did it.
However, I think it is more likely that we are seeing Dubai police incompetence, accusing anyone who was on Mabhouh's floor in the Rotana hotel, than a bizarre Iranian conspiracy to kill a business partner.
There is also this interesting tidbit from CBS:
The members of the hit team – at least a dozen men and two women – can be assumed to have been wearing disguises at every moment they were caught on camera. Antonio Mendez, former chief of disguises at the CIA, years ago revealed to CBS News that ultralight latex-type masks that fit completely over the face – and make you look like a completely different person – are real and not figments of the "Mission: Impossible" screenwriters' imaginations.This would mean that the agents are not "burned" after being seen on camera in an operation like this.