I don't see how that can be the biggest lesson. Someone at the service provider bypassed their own protocols in order to hand control of the system over to an unauthorized user. Even with local backups he would have needed to restore the servers because Namecheap royally screwed up.

Yes, you should always have more backups than you need. But wouldn't you be moving to a different provider after something like this anyway?