The name listed as the registrant is supposed to be the owner. As a practical matter, if the name is at a location where you can change the info in the registrant field at a moment's notice, ownership belongs to whomever controls the ability to change that field.
Yeah, but if he doesn't control it, lots of places let the Registrant field be changed at any time by whomever does control it.
So, if, say, someone sells you a name, lists you as the registrant, but doesn't give you control, as the a practical matter you don't really own it, as he can list anybody he wants to be the registrant at a moment's notice.
We have to look at this at 2 different levels. Technically, yes, if you control the Admin e-mail ALONE, you can do A LOT of things from registrar transfers to even modifying the registrant field (at most registrars). So as an end-user, you have to very careful who is in charge of that. HOWEVER, your last defence is actually the registrant field. That establishes your legal status as the owner of the domain name. Make sure you are properly listed there, or you stand a very slim chance even when you bring your dispute to court. I actually have a client who basically knows nothing about these stuff and was silly enough to let her previous designer registered her domain in his name. Now, this guy is asking for a ransom (a larger than necessary job) in order to transfer it back.
Heck, at many registrars you don't even have to be listed as Admin, you just have to know the account name and password that controls that name. Everything that appears in whois can be changed at a moment's notice. If you don't actually control it you'd have a neary impossible task to try to get control if the registrant and whois info gets changed. Own and control or else you could be very sorry.
Namedropper wrote: "So, if, say, someone sells you a name, lists you as the registrant, but doesn't give you control, as the a practical matter you don't really own it, as he can list anybody he wants to be the registrant at a moment's notice."
Namedropper, you are right. Practically thats true. In theory its just like nameslave said. The key thing is prooving your registrant/ownership status. And this can be done by contacting the registrar, who should track whois changes...
That's exactly what I mean by 2 different levels. Getting a car key doesn't mean that you OWN the car, even though you can joyride or even sell it to some underground garage.