That sucks! I guess this is a lesson for why we need to keep the domains “Locked” at the registrars, then would it not also require that they had access to your emails for the authorization codes, etc? I know at Godaddy getting a domain transfered is kind of a hassle even if you legitimately purchased the site.
Best of luck to you! 