Mystery solved. The domain had been previously registered, but the owner had let it lapse. But they recently logged back in and paid for it again and I guess the left hand didn't talk to the right hand.

Now everyone's got to sort out who gets the domain, but at least it appears that no personal info was stolen in the mess.