alt Hacker NewsI did have domain privacy enabled. NC allows people to initiate a password reset via username, email address, or domain name.
I was a happy customer right up until this incident. And I certainly agree that due diligence is a must for something as critical as a registrar.
Glad you posted your experience. I'll definitely be keeping my eye out for shenanigans on my own domains.