The first way is, under United States law, the Anti-Cybersquatting Consumer Protection Act, also known as the ACPA, allows for somebody to file a complaint, and if they can successfully establish that they have trademark rights in a domain name, and that it was registered or used in bad faith, with an intent to profit, then they can get the domain transferred to them and also get statutory damages up to $100,000 per domain name.
Besides that ACPA legislation, there is also what's known as the UDRP, or Uniform Dispute Resolution Process. Which is an arbitration that allows somebody to file complaint and have an arbitration panel decide, usually within a 30- to 60-day time frame, whether or not the domain should be transferred to the person that filed the complaint.
Usually what happens is one of those two things has occurred, either they have filed a UDRP or they have filed a ACPA law suit. What the defendant or the domain name user registrant or user says is, "I have legitimate rights in this domain, I'm not cybersquatting, and what you're trying to do constitutes reverse domain name hijacking."