You can tell if it's a password scamming email because it says "Jagex LTD" instead of "RuneScape". It also probably says "dear player" instead of your actual in game name. It should look very different from the password change email you have just below.
Once you're able to confirm that the "account received an infraction" email was actually fake, you should then report the buyer.
You can see that it was a Significantly not as described dispute from the imgur photo.