Originally Posted by Shoplifter

It seems like a well planned event, hitting a high traffic domain on a long weekend. They can install toolbars at will until Tuesday.

To my mind it seems like something someone may have been working on for a while.

You have my real sympathy with this Sleazy, this is one of my nightmares made real.

I'm very curious how they did it. If the domain wasn't locked they would have to know your email, but if it was locked they would have to know the email and the Registrar password. Have you checked your machine for key loggers or any other trojans? They may have been able to pull and then decrypt your stored password file, then they would have been able to get them all at once.