Domain name not locked and I forgot password

[Fauna]

A couple years back I bought a domain name using an old debit car. I not want to use it and found I can't because I forgot the password. So I have to get a utility bill, my ID, all that stuff, copy it, and so on.

To make it worse the e-mail listed is an old AOL account that I can't get to anymore.

At whois, it says: status: ACTIVE

I think this means not locked, right? I don't think I ever locked it, and with the new ICANN regulations, how can I make sure no one steals my domain name while I'm going through the crap to get access to it? How easy would it be for someone to steal it? I hope it's not as easy as they say!

[mcavic]

In order to transfer a domain, someone still has to reply to the email that's sent to the address listed on the registration.

So nobody can easily steal it unless they have access to the email address.