Through RuneScapes website........

no because, they get linked to rs3, and all rs3 asks for is the current email address of the account.

and then they post a mail to the (current) email like do you want to change the password etc, but if you have bought the email, and the owner has no acces to the email, the account will be yours.

How? like what are the ways that a person can recover his/her account?

Like deceiver said, they'll have every bit of information regarding the account. That tops having the original email by a mile. 

When I bought my RS3 account, I asked for every bit of information that could be used to recover the account. I asked for stuff including last 4 digits of cc used to purchase membership, phone provider (if they bought membership with phone), countries been to, previous passwords etc. Stuff like this would generally be used in a recovery test

I think the best way to secure an account would be to add authenticator, but of course if the owner recovers the account it can be removed.