How? By finding bugs in the interface that allows hostile users to set new values for the email address at the registrar and using this for triggering the 15 days period?

Why bother with looking for interface bugs? Domain owners have been told they risk losing their website if they don't respond to requests for confirmation of the details of their domain name. So how about I send some emails asking them to urgently pop by my website, which looks very much like the registrar's website, and log in to update their details?

Or if I didn't want to do anything actually illegal, I'd probably have an enhanced chance of success in pulling off the Domain Registry of America scam and convince people they must update their details [by transferring to my registrar] in the next 15 days.

Seems almost certain to become the most frequent uses of the contact details ICANN has kindly ensured will be up to date and accurate.