theoretically speaking the guy can claim the account back as if it was stolen - being a person who registered account he can easily ask the registrar to do so and they would because they have his IP and initial reg data (name, address etc) in their logs - not yours. if the name is of considerable value for you i would push it to my own acc or transfer it out immediately. and keep the proof of payment... generally its bad idea to take someone elses account with domains - it doesnt change domain ownership explicitly as it would in case of push/transfer..