I wonder how long it would have taken to be noticed if he replicated DNS and sat on it for a while. Better yet, how long if he had redirected or cloned the site.
Not sure why you're getting downvoted. Setting the NS records to their original values would make the whole thing transparent unless you dug into the domain ownership.