I suggest you change the password immediately, maybe contact them to see whether such a request was made, and by whom.
And make sure the domain is in locked status (this prevents unauthorised transfers).
Domain registry of America is one huge scam by the way - do a Google on them for more info.