IANAL, but in Arizona, at least, and probably many other states, the act of domain hijacking is a felony (it's considered unauthorized computer access, or some such language). So is ID theft. There may be federal statutes at work here as well. You should see if you can get the proper authorities involved -- they'd at least be able to subpoena the registrar's records to track down the attacker.
Granted, you'll have to get the authorities interested first -- usually they need to see significant monetary damages with criminal intent. But it's another avenue to explore if you're challenged by the legal fees (and who isn't these days?)