[tomlogic]

It's not the case with GoDaddy. I just had a hosting client run into this a few weeks ago -- someone they know had registered their domain for them long ago, and they didn't have the GoDaddy login. I tried to help out when their domain expired and spoke to GoDaddy support. They do not provide any way to renew domain without logging into the account that owns the domain. They were fortunately able to get in touch with the person who originally registered it, so that person could renew it and work on transferring it to an account controlled by the true "domain owner".

I personally don't see a security issue with allowing anyone to renew any domain. It's not like you can change WHOIS information or the authoritative name servers -- you're just paying to continue with the existing ownership/configuration.