A registry is little more than a DB at heart. In EPP you'd of course send a request with password, it'd go pending Transfer, need to be acked, etc. But nothing stops an employee from just changing things manually, outside of company policy and restrictions. Due to the large amount of immediate domain takedown requests(usually some danger or highly illegal activity involved), there's always a process in place. It sounds like this fault lies on the Gov't agency making the request, for not doing its due diligence prior.