I bought a domain name from a domain squatter who used Epik and there's a 60 day waiting period before I'm allowed to transfer the domain away.
Their site is one of the buggiest I've ever used (no, really), so this hack doesn't surprise me at all. Now I'm trying to remember how much personal information I would have given them.