So the recovery account can be used to make a new password on your account and "Challenge Owner" if someone steals your account. In most cases it cannot be used to steal someones account (as someone would need to have the recovery account) and it takes 30 days to change a recovery account.
This isn't very in depth but if you have more specific questions I might be able to help.