CIRA should really have a policy that any domains not paid for must be re-auctioned within a certain reasonable time frame. The only reasonable excuse for waiting 18 months is that they were accepting payments this whole time and the guy just defaulted.
I remember catchdrop was doing that too and when I complained to Richard, he talked to catchdrop and catchdrop just said "oh right, those were domains we acquired testing out our TBR system" so Richard made them re-auction them, which I believe they did. They weren't great domains or anything, but to me it was the princple of making sure they didn't think that was OK.