WOW, a TV news magazine segment, at least is developing here. What a sad escapade for Go Daddys main great drop. The name 'Ouch.COM' is just WAY too appropriate to be the name in dispute here.
I do agree that all of the involved parties including ebay, etc. should be notified as should the appropriate police agencies. Also, Attillo should hold the domain or turn it over to some certified third party till the true ownership is determined. Unfortunately, even if unwittingly, if you buy stolen property, you forfiet the money spent for that property and have only the ability to attempt collection from the person who sold you the property. I haven't figured out who scammed who or if they are even present here in this thread. I do believe that legal ownership belongs to the last person who had legitimate (and paid) ownership of the domain. I do also know that with tangible merchandise it can be very dificult to collect debts or start legal proceedings especially if they are out of state or, God help, out of country. We had a business selling radio station equipment and you'd be shocked to know about some of the scum in that business. There were guys who would buy about $5,000 from everyone with bad checks or who would dispute legitimate credit card sales routinely with everyone. About all that you could do with them is try bill collections which usually didn't work. The 'law' didn't give a damn. The point here is that we discovered that the authorities really didn't care at all if it was a B2B sale and the amount was less that $6,000 or so. We tried to go to a lawyer over $7,500 worth of essentially stolen gear the first time this happened but the first thing that we needed to do was to pay him a $6,000 retainer and he doubted that that would be the total amount. The attitude here with sate Attorney Generals is basically, 'well, that's just business'. It isn't, but that is the sad reality. If you were to take $2.00 from a 'little old lady', that, on the other hand, may result in jail time as the attitude is entirely different in a B2C relationship. My fear here is that a domain name, even if a 'little old lady' was involved would be seen as a B2B relationship.
I hope that those involved can work this out and that whoever the guilty party is can be penalized but, at minimum, whoever, possibly unwittingly, bought the stolen domain from the person who scammed it and any subsequent buyers need to realize that they are likely SOL now. My feeling is that they domain is Atillos for all practical legal purposes to use or to return to whoever he feels is the legitimate owner in the end although all possible solutions utilizing police, ICANN (if they care), and the other intermediaries (GoDaddy, ebay, PayPal, etc.) should be persued before any informal settelment.