Membership can be cancelled without access to the account. Go to the Cancel Subscription support page and follow the appropriate instructions.
Also, if the account is hijacked, you should take steps to secure your device, force the hijacker out and then re-secure your account. Instructions: Hijacked account Jagex will also investigate the hijack when you submit a recovery and take action against the main account of the hijacker.
p.s. re your card. A hijacker cannot use the card offsite as the full card number/expiry is not visible. They might be able to use it to buy Bonds on your account if you left the "remember my card details for next time" box ticked.