If there isn't 1) intent for defamation, and 2) identifiable damages (monetary) then there's no viable lawsuit; and arguably any reputation "damage" is deserved if the organization they're in charge of allowed this to happen so easily.
No, nobody deserves "reputation damage" for the misbehavior of their company (and here, the one at fault is another company).
Is there really no legal basis to sue someone because of this? Is that clearly not malicious behavior from the one who transferred the domain?
The domain could be haha.com it would not matter.