I found last week that Namecheap enabled auto-renew of both the domain and whoisguard by default:

http://imgur.com/hoGfojZ.png

If you click-through the checkout with the 'Confirm Order' button at the top right away you can miss that detail - as I have twice.

One of the reasons I switched to Namecheap in the first place is because they were a registrar that didn't rely on bundling tricks. I'm considering moving all of my domains away.