Don't forget about the guy whose twitter account was stolen because a hacker got access to his email _because_ the weak link was a custom domain and poor security at Godaddy. The domain was hacked, giving the attacker full access to email, and therefore ability to change passwords, transfer ownership of a prized twitter account and more. It has been discussed here quite a bit. The folks that answer phones at domain registrars don't usually have adequate training and social engineering is common.