I had something similar happen to a client using Cloudflare. The attacker somehow was able to establish a new account(s) at CF that used the same free nameservers as my client. When my client's domain expired the attackers added the domain in their CF account, and were then able to control DNS. I reported it to CF security but I'm not sure if the loophole was closed. What I don't know is how the attacker was able to get an account with the same nameservers which are seemingly assigned at random (maybe not?). Maybe they just own/operate thousands of CF accounts?
Update: CF claims to have closed this loophole: https://github.com/indianajson/can-i-take-over-dns/issues/10