This is called "front-running" by the domain name registrar and it is a big no-no. Fortunately it's not what happened here though.