First of all: if your password has been changed, your email has been hijacked too. Make sure you run a pc scan first, then set a new password and authenticator on your email
If you get the message that you have to recover from inside the game, try this: Start the runescape client. Enter your login name there and click 'forgot password', then proceed to send a recovery there. If the hijacker changed the registered email (you can see if it's changed if the starred out email doesn't look like your email), click 'I don't have access to that email' and submit a full recovery.
Member of the godless. It's not that I don't want to devote my soul to an RS god, the problem is that I can't find it.