Let me tell you of my own experience with MIT changing passwords.

In early July a customer of mine asked me to take over the running of his 
web sites and domains.

There were four domains in total. He had registry keys for two of the 
domains, he didn't have them for the other two. None of the domains had 
current email addresses. After the AUNIC to AusRegistry changeover the 
registrant contact name on some of them had also been changed to "THE 
MANAGER", though the customers name remained as the tech contact. However 
Melbourne IT had taken the option to update contact details offline so I 
had no way of changing even the two I had registry keys for.

I redelegated two of the domains and submitted paperwork for the other two 
to retrieve the registry keys and requested an update to the contact email 
addresses. Several weeks went by and despite several emails to Melbourne 
IT, I had received no response beyond the automated "thanks for your 
message". In desperation I decided to send the faxes through again. About a 
week later I finally received the registry keys. I had requested that they 
also update the contact details (still no way to do this myself) but they 
didn't.

I now went happily about my business and redelegated the domains, checking 
the Melbourne IT web site periodically for the resumption of the change 
contact details service so I wouldn't have to go through this again.

Some weeks went by but finally the change contact details feature was back. 
I thought I could finally finish off this job. I logged in and changed the 
contact details for the first two domains without a hitch. Then when I got 
to the third, the registry key didn't work. Same with the fourth domain. I 
checked them and they were the same ones I had used previously to 
redelegate these domains.

I phoned Melbourne IT support and explained the registry keys no longer 
worked. I was asked whether the domains had been purchased or renewed 
through ING. I said I had no idea, they had been purchased by my customers 
former web developer. Anyway he went and checked and confirmed, yes they 
were purchased through ING and as a "security" measure all the registry 
keys of their customers had been changed.

I explained that I had been unable to update the contact details and asked 
whether I would have to go through the whole process again. I was told yes 
I would have to complete the registry key retrieval form again and send it 
in, as well as request a transfer of the domain from the ING account to the 
Melbourne IT account.

I did this and several days went by. I received a couple of emails from 
Melbourne IT telling me that the requests for the registry keys had been 
rejected. Their reason was that the person signing the form was not listed 
as the authorised contact for the domain (remember, the registrant contact 
name has been changed to the generic "THE MANAGER"). I would have to get a 
signed letter to that effect and resubmit it (again).

My customer is sick to death of completing forms and writing letters and 
thinks the whole system is a joke. They are sending in the signed letter 
today and maybe we might finally get this whole mess sorted out. But 
frankly I'm not getting my hopes up.

At this point I would prefer to just transfer the domains to another 
registrar. Of course as the registrant contact email addresses are invalid 
that is impossible. I can't win.

Wayne