yes but he can log in again and change it again...
How?
=squeak=
edit: to change withdrawal address, you have to sign something using your address (as I understand the procedure). once the withdrawal address is changed to whoever the account is being sold to, then changes made to the account from that point, can only be done by signing with the new address.
You understand correctly. Utilizing message signing with btc addresses basically eliminates the repossession of an account. I say basically, because there are always holes in systems, if not in the software, then in the person.