If you can log into the domain to change nameservers, why don't you log in and unlock the domain, make a note of the domain's authorisation code and change the Admin e-mail address to your own.
Then set up a new account with a different registrar (controlled by you and no-one else) and transfer the domain to your new control panel - you will already have the Authorisation code, the domain will be unlocked and any authorisation e-mail will get sent to you as the admin e-mail contact to approve - hey presto, problem solved
