Or don't transfer the name proper at all. Well, don't transfer it but monitor email on it for six months.
That way you have no security issue at all.
You want to be helpful to the new site runner of course, but it would be much safer to hand over copies of the site and relevant databases (sanitised where needed, of course) then point the relevant A records to his/her web server and forward things going to relevant email addresses that way too.
You have no security issues, they get the domain to keep running the site under and can respond to mail sent to site related addresses, and the other users of the site should see minimal (if any) downtime if the transition to their web server is done well. Everyone should be happy with that.
If the new owner wants fuller control of the domain at a later time, they can perform a managed transition to a new domain without needing to involve you (host under both old and new names for some time by advertise the new name, then start responding to requests for the old domain with redirects to the new (if you use the right redirect search engines rankings should not be lost), and finally replace responses to the old name with "please update your bookmarks" after a while longer).
You'll want to transition completely off the old name yourself of course. Do that in the phased way others have suggested, but don't get rid of the domain, at least until you are 100% sure that absolutely nothing you care about will ever go to it my email. Keeping the domain active will only cost a few $ per year unless it is one of the novelty types, or otherwise under an expensive country-specific TLD, or registered with an unnecessarily expensive registrar.