Nominet don't do any verification when these transfers are made.

Most registrars I've checked don't do any verification themselves either.

Here's an example of the race conditions many registrars fall to: http://blog.pricechild.co.uk/2016/06/uk-domain-transfers-are...

Nominet allow you to enable 2fa on your account but this means sweet fa. It doesn't stop transfers by other actors.