Actually, from looking at your record, I would guess that instead
of an unauthorized modification of your tld, a (perhaps unauthorized)
modification of one of the servers has occured:
Your exactly right. IHMO, not having some sort of guardian authentication
(as was the problem with the es tld) is inviting trouble. If you don't have
guardian authentication working on your domain, please look at
http://rs.internic.net/guardian/ and get your domains administered
by the InterNIC protected against unauthorized changes.
Regards,
Mark