From: Narcle
I wouldn't boost about stealing the account. However this is very informative as you said its easy to take an account that has no recovery questions. I would think that's common sense, it just shows how lax Jagex is about account recovery with no recovery questions.
@ people always get caught stealing accounts
WRONG.
You only hear about the ones that get caught not those that are good at it - hence don't know of or about them.
Well not boasting as much as declaring the fact that what I originally thought to be a super secure recovery portal(it's honestly 100x better looking than 3 years ago, when I was denied my recovery request for some BS reason), is not secure at all. Not only can you get accounts that were yours(who have been played under other IPs for a very long time), but you can also get other people's accounts who you have never played on ever. I don't know their methods of assessing the validity of your recovery ticket but I do know this: I set the recovery questions and made sure ALL my accounts are bullet proof, after this finding(3 recovered accounts in under 2 days).
Seems like somebody at jagex is bored of his job assessing these and is just pressing the green button :O
And oh, it's not luck. You can try it on an old botted account that never got banned. Give someone your password and then try and recover it a little bit after… making sure you don't set recovery questions of course. Hell, you could even try to recover it when you were obviously playing on it. It seems to be easier than anyone thinks it is.