tl;dr: A 13-year Namecheap customer reports that support handed over his account—password reset and email address changed—to a third party who simply called and claimed the domain belonged to him, with no verification. Ironically, Namecheap had already phoned the real owner to verify an unrelated support ticket, proving they could authenticate but chose not to. The user has since migrated his critical domains elsewhere.