I have never purchased a domain from Yahoo, so I can't be of much help to you.
Not sure how the domain could have been transferred if it was locked and had a valid administrative contact email address which was under your control.
I can only suggest that you change your registrar account passwords immediately and verify the administrative email addresses for all your domain names, just to be on the safer side.
Hope you get this resolved.
This set me thinking about the best practices for securing a domain and I did a few searches.
article will help others too - I found it informative.