Once you have the account secured via changing the SQ and Password, you still have one more step. Microsoft now makes you receive a security code from the confirmed email on the account for anything billing wise. If the confirmed email is not yours but you need to change the billing info on xbox.com so the seller can not contact support and regain access, you can recover the account on your xbox, then press the guide button, go to "Account Management" on the far right, then go to "Billing Information" and sign in. You can then change that without a code.
Billing info is what support uses to verify your ownership, so if the seller knows it, he can regain access that way.