Anyone, anywhere, can now transfer out your domain name without prior approval or warning email to you if it is not locked. This is because of an incredibly stupid ICANN ruling that was initially meant to stop evil registrars from holding your domains names hostage but will now have serious repercussions on innocent people.
Now any evil-doer can hijack your domain without ANY way for you to get it back quickly. You will have to file with WIPO for $1000-$1500 and sue back for ownership. And trust me, they will try to steal your domains, I've already experienced a few attempts.
Don't expect registrars to help you, they won't get involved.
Note that some TLDs use EPP keys which will prevent this, but many like .com do NOT.
Expect to see many theft stories hitting the news for the rest of this year.
Don't become a victim, check all your domains for registrar-lock NOW.
Previous thread:
[webmasterworld.com...]