Originally Posted by Rob

They provided the login information for their registrar so he could point the nameservers. I have the login information for all of my clients' registrars. But since he also had access to the server (mail), then he could have easily forwarded the email to himself, initiated a transfer, authorized it by intercepting the email, and then completing it through the registrar's admin panel.