Well if you mean if they can recover right back. Yes they can so you have to change password for the email. Bu other then that use a middle man and its legit.
Actually the original owner can always call up Microsoft. Someone scammed my account, changed the WLiD associated with the gamertag, so I called Microsoft. Took em' a while, but I got my account back.
So the best way would be to buy from a trusted member!