I think the most likely explanation, if anyone is doing this, is an employee watching a log file and doing it on their own for domains that sound particularly desirable to them.