It looks like the attacker got access to the Gmail account that was used for managing the domain. He set up a filter on the inbox forwarding all incoming mails to another E-Mail address. This way he also got access to our registrar GoDaddy and transfered our domain to the registrar OnlineNic. We contacted the GoDaddy Undo department but haven't got an answer yet.
