I went through a similar scenario a few years back. Back then Network solutions were pretty much the only game in town so I'm going to describe their procedure. As the registrar is probably someone else now the procedure may differ.
Anyway I got in a similar situation, the domain had been registered by a website design house who wanted an excessive renewal fee, which we cancelled.
It was after that that I discovered that we didn't have control over the domain, the administrative contact was an email address at the domain in question.
So I looked up the procedure for regaining control, the first thing was to send an official letter on company paper (there was a different procedure for private registrations, but its similar) which meant I could get myself listed as administrative contact for the domain. Depending on the registrar the steps may differ but you have to get control of the domain.
As administrative contact I was able to remove the duff contact info from the domain and manually set the domain name servers to Plusnet's servers
After that Plusnet could transfer the domain in, though at the time it needed a ticket raising.
Further advice: If you want a smooth transfer without going a few days inaccessable then (assuming your existing hosting hasn't been canceled already) you need to add Plusnet's domain servers in third and fourth place, leaving the old ones in place. Then when Plusnet's transfer process is complete you delete the old name servers.
