Presumably the approval was the accident. (Or not renewing yet, so perhaps no approval necessary.)

Also, 'transfer locks' are a good idea, but not supported by all TLDs.