The whois shows that it previously expired in April 2012. I thought most registrations were for 1 year increments, so this would be a strange time for a expiration.
There's a fairly long grace period after initial expiration when a domain is expired but can't be re-registered. It allows for the original owner to get it back (for a larger fee) before it's sniped by the next person.
Nothing requires the new owner to immediately change DNS...
The update date was 9/17, which presumably reflects the date of transfer. So this just happened today.
Well, an update was today. Perhaps another transfer? We don't quite have all the facts.
Their twitter says it was on auto-renew, and their domain is through the same company as their hosting. If their autorenew didn't go through, their hosting probably wouldn't either, so it's hard to believe that their host would have let them skate by for five months without payment.