Doesn't matter whether it's for a sale or for your friend to try out; once the info is out, it's out, until you change your password. And even then, having people know about your account name alone in the first place is also anything but good.
Endless Online has always been known to have insufficient account recovery; that's probably where you should continue to level your expectations at. If your account got "hacked" (by which I mean you gave out your account information, someone logged into it and changed the password without you knowing), there really isn't anything any admin will do for you. Not because they can't, but because they have no way to prove that you didn't make an account sale and simply want to steal it back. If they start handing out account recoveries to the honest people, they also have to do it for the ones with bad intentions. Get it?
So what am I trying to say, bottom-line? Keep your account info safe with no one but yourself. That should be common sense by now.
-Cruside