When you buy a D3 account, you're actually buying someone's Battlenet account.
You need to secure the Bnet account, this includes receiving login info, secret question/answer, updating the email and adding an authenticator once you're done.
Once this is done, only someone with an ID matching the name on the account can recall, which means the original owner.
For Bnet accounts, the OO can always recall, which is why it's so important to buy an account from someone that's trusted.