One registrar that I see being accused of this a lot is GoDaddy but I have been using them for years and never had this happen to me. I think some of the people may have either spyware that is watching this or perhaps have used other 3rd party sites, like someone mentioned. I just don't see why GoDaddy would do this themselves.