Historically, registrars haven't offered robust security controls. CloudFlare, a security provider, recently announced a new service that protects its customers from domain hijacking since the problem has been prevalent. Most companies or individuals assume that high profile name servers are most at risk, but smaller name servers can serve as gateways to other controls.
To hijack a domain, an attacker needs to take management of the user's control panel. Through Whois/RDS, which is public record, any Web user can lookup domain ownership and, in many cases, the associated administrator's email address. Armed with this information, the attacker can use the email address as a backdoor into the domain name, brute force the password to the control panel, and reset the password, locking out the legitimate owner from his or her account.
