Originally Posted by 3M TA3

It doesn't mean they will have the ability to transfer it. You will still get an email being the registrant notifying you of who is trying to transfer the domain from the registrar. So when you reinitiate the domain transfer make sure you read who and where it's going.

Chances are, if you don't annouce the domain that you are tranfering then you won't have thieves at the gate waiting to transfer it to themselves.

If you read their email it's pretty clear.