First off.. that really sucks.
Registrars now have a domain locking function that I believe will keep this from happening.
It costs extra. Worth it, but shitty that they even have to charge for such protection. KatVixen had this same thing happen, (if I remember correctly).
Is it more common on registrars like Godaddy?
Sorry !!!