As it was, I'm not sure what (if any) validation was performed - no secret code matching, no email to say "hey, do you agree to move domain X between registrar Y and Z" - only setting the registrar-specific IPS tag; if someone with the same registrar had put in a transfer request at the same time, how would it have known the right one...

*shrug* Guess I should just be happy it worked.

Maybe next year I'll do a multi-year renewal and hand round the begging bowl then. :)

Though that would also be adding another thing which could go wrong, and I presently have enough already gone wrong things I need to focus on resolving for the time being.