Scammers are getting better and better at making phishing emails look real. As Monky said, JaGex will not email you out of the blue like that. If they need to contact a player, they use the internal message system.
Besides, if they thought you were selling your account they would simply ban it.
Yeah like they ban the bots - o wait
kidding but yeah jagex do email you now if you have your email registered but I don't think it would ever be an email like this regarding account security or anything, that's a typical scare tactic to get you to click the link like the antivirus virus (ironic?) I had recently that says I had a million trojans and to download totallynotakeyloggerhonest[Caution: Executable File] now or else my computer would explode with the force of a million suns. Anyways if jagex emails you legit or not just never click on a link obviously or just do what I do and never check your emails, ultimate safety! (or laziness but hey, I've never been hacked either way)
edit: tip.it censors dot exe, touche