What about the security angle? The registrar should log these transactions with the IP address and probably the UA string so they can tell the customer what computer they were using when they did it. And if it wasn't them, then investigate how their password was stolen or security was breached.
I could believe this - once you have load balancers, multiple proxies and different servers all over the place - getting the IP address of a request can become difficult.
If there's no business driver in making that happen, then it quickly falls by the wayside and you are left without the "luxury" of that information being available in a readily accessible form (i.e. suitable for a CSR).
You can argue that that isn't acceptable of course.
Does your registrar log information like this?