Tucows should have a log of the IP addresses that have accessed your account, changes made, and so on.
If your tucows reseller has locking setup correctly, you would have to request the reseller to unlock the domain to make changes. And then request the reseller to relock the domain when you are done. As long as the domain is locked by the reseller then no transfer can take place. Unless of course they act on a bogus email or phone call.
The important thing is don't share your user names and passwords.
Adding an email requiring an aknowledgement to make the changes that were made would be nice...
but
wouldn't the same person also be privy to the password for the email account? And be able to intercept that email and respond for you also?
You will get your domain back. It's just going to take some work and preservance.
