Having read through Chris' account of what transpired, I seriously doubt this is simply a hoax. It's quite disturbing that this has happened to him (or anyone, for that matter) and even more disturbing the PlanetDomain is under absolutely no obligation to return the domain to its rightful owner.
One thing I will point out, however, is that his domain admin email account is a Gmail account. I've always gone with the theory that for email accounts of great importance (such as one used for domain name administration) one should use a decidedly more secure email provider than Gmail. After all, you do get what you pay for, and Gmail (as we all know) is free. Google is under no express obligation to keep Gmail users' email accounts 100% secure and there is no recourse (financial or otherwise) for a user should their Gmail account be hacked. I'm certainly not saying that "Chris had it coming" or anything like that just because he was using a free email account, though I can't help but wonder if he would've encountered the same problems had he an email account with a subscription-based email service such as a hosted @mail or Rackspace Hosted Email account.
What's done is done, however, and it's all water under the bridge now. What's important now is how and if Chris regains control of his domain. GoDaddy accounts seem to be quite vulnerable to domain theft (judging only by the cases I've heard of, nothing more) so hopefully GoDaddy can implement - at the very least - some account access log solution which customers themselves can access in situations such as these. That said, it really wouldn't help Chris in this current situation much at all.
It'll be interesting to see how this pans out, that's for sure.
--Entropy