There doesn't have to be those things to make your life hell, at least not in the US. There just has to be enough of an argument where a judge will be OK with bringing it to court - and even if he isn't OK with it, you'll still have tons of lawyer fees to deal with.

Either way, I think it's irresponsible to target a random employee and throw journalists at him.

No, nobody deserves "reputation damage" for the misbehavior of their company (and here, the one at fault is another company).

I mean, what kind of domain name are you imagining is being registered and transferred to them? I'm imagining something relatively mundane but funny.

The domain name must be paid by someone. After the transfer, if the employee is not up to date with their inbox, they may end up paying for something they did not consent.

Is there really no legal basis to sue someone because of this? Is that clearly not malicious behavior from the one who transferred the domain?

The domain could be haha.com it would not matter.

You're responsible for checking your credit card for fraudulent charges, too.

And if you're responsible for fraudulent charges on someone else's credit card, you can get into a lot of troubles.