Okay this is what happened. I found an acc I wanted and asked the guy what he wanted. After he told me I found an armory on the wow forums and then made a toon on a private server with the exact same gear and took some SS's. Then he gave me his info and I changed pass and email. An hour later he had his acc back.
So my question is, how can I lock down an acc so after I scam it they have close to no chance of getting it back?