But locking all of romanh's domains, so he can't take his business elsewhere, and transferring all of the traffic intended for his systems to somewhere else, does sound a lot like blackmail, not to mention blatant violation of how domain registration is supposed to work.

Also, $240 because of one chargeback, and doing the above while the customer is trying to sort out a fraud issue? Neither of those sounds like normal practice for a responsible domain registrar either.

Obviously there are two sides to every story and we're only seeing one here, but that one does look pretty bad for Namecheap.

Please see my comments above - there are ways around this but it appears that that path was never pursued.