Update:Like Jason, my a*s is also a little sore from being fact checked. There is no conspiracy :-) as Ross pointed out in a comment The policy is for registrar transfers NOT domain transfers! See Ross's blog post, Jason's updated blog post and Michael Moncur's blog post for more details.

Jason nails it. Time to lock down my domains and complain to the "black helicopters of the Internet" (TM) :-), ICANN.

From ICANN's stupidity and what to do about it (kottke.org):

QUOTE

What this means is that any dufus can drop 20 domain names into this form at register.com, hope that a couple of those folks don't get the emails from their registrars about the transfer (because they're on vacation for a week, the email gets spam filtered, etc.), and take those domains from their rightful proprietors. You probably have some sort of recourse through your registrar or ICANN, but I wouldn't expect it to be particularly timely (more than 5 days certainly) or rigorous.

So, what can you do about this? Some suggestions:

1. Make sure your contact information listed with your domain registrar is up to date. If a transfer request comes in for a domain you own and your email address on file with them no longer works, you won't hear about it until your domain name redirects to big-hot-mammas.com.

2. Don't go on vacation for more than 4 days or have someone check your email while you're gone. Impractical, but whaddya gonna do?

3. Make sure your spam filters aren't filtering out email from your domain registrar.

4. Some domain registrars allow you to "transfer lock" your domains. Do so now. According to one disgruntled register.com customer, register.com has no such feature at this time....you're on your own, sucker!

5. Complain to ICANN...here's some contact information and their Board of Directors.

UNQUOTE