ENS cannot forcibly transfer a name. Only the wallet that holds a .eth name can transfer it, and on ENSv2 that wallet must also have the Can Transfer role on the name.
How a .eth name is held
A .eth name is held onchain, on Ethereum Mainnet. Changing who holds it needs a signature from the wallet that holds it. On ENSv2, roles also say which wallets can do what with a name, such as transfer it or change its resolver: see Grant registry 'roles' to manage your name.
Anyone can renew a .eth name, including someone who doesn't hold it. Renewing never changes who holds it.
Approaching the holder
You can try to reach the holder yourself. Some holders add contact details or social links to their profile. See Find the owner of an ENS name.
When a name becomes available
A holder who keeps renewing keeps the name. Every .eth name has an expiry date. After it, the name has a grace period: 28 days for a name on ENSv2, or 90 days for a name that hasn't been upgraded. Upgrading adds free time to a name to make up the difference, so the last day to renew is the same either way. In the grace period anyone can still renew the name at the normal price, and nobody else can register it. If nobody renews it, the name enters 21 days of Price Cooldown: anyone can register it, with an extra fee that starts at $100 million and drops fast to $0 by the end of the 21 days. After that it costs the normal price. See .eth name lifecycle.
Reporting misuse
Third-party marketplaces have their own reporting tools. Report it to them directly.
If a site loads through a gateway like eth.limo, report it at eth.limo/dmca.
Reporting a name doesn't move it.
Common questions
Can you tell me who holds a name?
Only what is public on the name: the wallet that holds it and the records set on it. See Find the owner of an ENS name.
Can you stop a particular name being registered?
ENS can't. Any wallet can register an available name. Only the registration price can be discounted. The Price Cooldown fee never is.