When you cancel a domain they reveal your contact information for some period of time. Maybe they can't help this, but I blame them anyway.

Overall I think they're pretty good.

Then, when the card is declined because it's expired in the two years since the domain was first registered, they start sending irritating debt collection letters demanding the renewal fee plus £15.

It's happened to plenty of people - just stick "1&1 debt collectors" into Google. I've moved all my domains over to a UK-based outfit called 123-reg; they're just as cheap as 1&1 but their renewals are done in a sane way, with a reminder email and the cancellation of the package if you don't pay.