Here's the famous Slashdot thread where the guy renewed passport.com.

http://slashdot.org/articles/99/12/25/114201_F.shtml#90

In the first situation someone paid $35 to get passport.com renewed for microsoft (before it completely dropped). This was back in 1999 when the internet was a tad more well behaved.

Hotmail.co.uk went through a complete drop and was simply re-registered by someone before Microsoft even cared.

In neither case was the domain hijacked though. The drop cycle is nearly 60 days and the domain would be dead for at least 45 of those.

There was a time when you could volunteer to pay for anyone's domain simply by using Verisign. Even further back and anyone who could fill in a form could get a domain for free.

I've been anonymously paying for the domain name of a local charity for almost a decade. The registrar they use doesn't care who renews a domain, anyone can mail in the form with payment and a domain they control written in.

You can still pay for somebody else's domain if you talk to the right person. The web dev company I used to work for had to do it a few times.