Here's your issue, you act as if the guy that got hacked had all his emails and shit hacked he didnt.
They got his email, great, they have his only emails = automaticly his payment email that is required.
They have passwords from old databases, one of those must've most likely been used a long time ago = another match, the info hackers have no is stronger for a succesfull IP.
In the same databases (most of them should atleast) they have an IP address, if users joined the site/forum the same time around as he started playing they now have 2 more critical information: His account creation ISP PLUS his account creation location since you can search up most IPs and it will give you an rough idea of where the user is from (not 100% exact, but outside the usa country and isp alone are enough.)
Both ISP and creation country are asked.
So what's left? They have his main email AKA most likely his payment email, they have old passwords from databases (and you're borderline retarded if you think a 10-15 year old had super security and didnt reuse most of their passwords). They have his account creation location and ISP from the old IP from breached databases.
What's left? Payment information AKA personal information ,everyone has facebook nowadays, who the fuck does not have Amazon/Paypal - You know that Amazon can reset your account if you literally only provide your email address and name right? Don't believe me? Go try it out.
Even if they dont "SE" the Amazon/Paypal customer support one of those passwords should work, the majority of the time it does work.
And if it doesn't, have you never ordered food? Clothing? who the fuck in 2009 for example would use a extreme strong password to order a cap?
There's your personal information.
They have the info now, all they do now is send appeals from a VPN with the location the guy either made his account at OR where he is playing from now - they don't only send 1, they send multiple, and you know what the best part is? JAGEX TELLS THEM WHICH INFORMATION IS WRONG
So they can search on that, passwords weak? fuck it try some more from other databases
payment email wrong? Aw yus this means he has another email address somewhere that might have weak security. (And you're delusional if you think people had strong security pre "2step" area or before old databases where hacked, nobody in 2010/2011 knew about 2step because it wasn't even avaible then.
The recovery system is perfect for the hackers, they already have all the info, all that could prevent them from being hacked is hoping the hackers dont have the info or their login names, but we've heard about those stories of jagex supporting giving away people their usernames.