I had a similar problem with Crazy Domains: they accepted forged documentation, turned off two-factor authentication despite multiple emails from me saying never to do so, and me literally being on a call with them as it happened. The domain compromise happened as part of a plan to hijack my OG Twitter username [1].

It took getting my country's NIC and regulator involved before they restored control of my domain back to me.

I've never gotten a formal apology from them, and the incident took so much out of me that I've never gotten around to pursuing them any further.

But fuck Crazy Domains, Dreamscape Networks, and Newfold Digital (fka Endurance International Group).

[1] see also: https://news.ycombinator.com/item?id=47859496