regarding how the scammers do it ...
some of the scams were done through a Gmail exploit ...




some scammers set up some kind of program that when a person visited a site (while being logged-in in his Google account) the program set up a filter in Gmail that redirected emails of the victim to the scammer's email account ...




then he went to the registrar of a good domain of the victim and initiated a forgot-my-password+sent-password-to-email-account procedure ... the email duplicated through the filter ... and the scammer got access to the account at the registrar ... then he transferred the domain(s) to his account (or changed the registrar account password and sold the domains through that account so that no changes would appear in the whois that might alarm prospective buyers) and hastily tried to sell the domains ...




a little after this exploit became known , it was said that Google has somehow closed the exploit ... but , also it is believed that many people that had became victims did not delete the filters in their Gmail account (even after Google mentioned that it stopped the exploit) , therefore their emails were still forwarded) ... if you got a Gmail account , it is a good idea to check your filters ...