Well, that means they have all the information you have, as WELL as having their email on the account. I'd reccomend you get the email changed ASAP. If they're unwilling to help you change it, or say that they forgot the email, I'd be wary.
I don't know much about this sorta stuff, you should probaly ask around before you do anything because you know what Jagex are like, they'll probaly lock your account.
IF their email is still registered to the account, yes you need their help. It will send a code to the email currently registered to the account, and you need the code.
You should be good man. The account can ALWAYS be recovered, assuming that the seller knows the original creation info, but since you know the payment info/recovs/ you should be fine.
The account can always be recovered as long as the other person has purchased mems and made the account. Well, even if he wasn't the creator of the account, if he knew the first password and had at least one of the agreement numbers they can recover it. Him having the email is only icing on the cake. Talk to Jagex and do whatever you can to get it removed.