He's fucked and has to hope the nice new domain owner will help him out.

That doesn't seem likely.

Yeah, exactly. I pointed out to them that I might be an attacker and my purchase of the domain didn't prove that I was who I said I was. They accepted that I was the person paying the bills, but said they couldn't do anything unless I was also the owner of the domain.

I figure that they either never thought through this process, or it was deliberately designed to make the cancelling process as awkward as possible. They're smart people, I think the latter.

So if they're going out of their way to be inconvenient to me, I'm going to go out of my way to never use their stuff.