Why can recovery questions and answers be changed in runescape without using existing recovery questions and answers?

Answer 1

Recovery Questions are made to allow getting your account back more easy. If you were to answer the answers to your previous recovery questions, especially if your password was recently changed, and the access IP of your account was different than normal at the time it was changed, your Recovery Questions will still allow you to get your account back.

________________________________________________________________________

does it mean if they have your password they can change your recovery questions and answers without knowing the question and answers? thanks a lot, before i thought if others have your password they could get your account.

________________________________________________________________________

Yes, however, this is for good purpose and it works just fine:

For example

Your account gets hacked, the hacker changes the password then the recovery questions

You go, try to log in, and fail

You go to recover account

You put in the recovery questions and password from right before he hacked you, as well as any other information you can (this is why knowing your old passwords is important)

The game will not, at this point automatically give your account back, however the system registers that your answers would have worked previously

A Jagex Moderator surveys your answers and etc, then looks at your account, he finds that YOUR PASSWORD AND QUESTIONS WERE CHANGED ON A DIFFERENT IP ADDRESS THAN YOUR NORMAL ONE, as well as the account has only been played on that other IP address since then

Your account gets returned to you

Hacker's IP is monitored, and his account history is checked, if he did anything that could have been bad, he may easily get banned (or any account which regularly plays on the IP)