First off, while purchasing any social media account there are some evident risks. If the deal sounds too good to be true, don't deal. Ask for the seller to validate original email by submitting a hacked form account.
The original email is needed in several instances while fully securing an Instagram: Breaking Email Links, submitting a hacked form account/recovering a stolen account.

Step One: Changing Your Email

You can change your email via the website or by the app.
You can do so, by going to "Edit Profile" and changing your email.
I recommend using gmail.com, or protonmail.com
While changing your email, add a "+" to the end of the email.
Example:
instagramtut+1@gmail.com
The "+" allows for the buyer to have multiple account's linked to one email.
The "+" forwards all of the +'s emails to be the original inbox. All emails regarding instagramtut+1@gmail.com will go to instagramtut@gmail.com

Step Two: Breaking Email Links

TO DO THIS STEP THE SELLER MUST HAVE ACCESS TO THE ORIGINAL EMAIL
After changing the email once, change the email two more times.
Example:
instagramtut+2@gmail.com and then changing to:
instagramtut+3@gmail.com

Once you have changed the email two more times, visit your email's inbox.
You will receive an email saying, "Email Changed On Instagram"

It will say:
Your new email is (insert new email address). "If you didn't change your email address, revert this change." (Revert this change will be a hyperlink)
Once you click 'revert this change' a new screen/tab will be opened.
The buyer will need to provide you the six digit code from the original email for you to successfully break links.
Not being provided the code forces the account to be locked until you are provided the code.
Once you are provided the code, a new screen will be displayed. You will have two options, "This was me" or "This wasn't me"
By clicking "This was me" you have successfully broken email links. If you click "This wasn't me" the account will be reverted to @example.com (you do not want that)

Step Three: Changing Password/Linking/Removing Facebook's

To link/remove a Facebook, it must be done on the mobile app. Not removing the other party's Facebook is one of the most common ways that someone pulls back the account.

To remove a Facebook: Log in to the mobile app and click the three dots at the top right of the screen. From there, go to settings and click on "Linked Accounts"
Click on Facebook (you will be linking the Facebook that you are currently logged into)
To see that the Facebook is linked, you will see a blue checkmark  to the right of the screen.
Once you have linked your Facebook account, log out of the account.


Underneath Login it will say:
Forgot your login details? Get help signing in.
Click get help signing in.
You will now see three options to access your account:
1) Use username or Email
2) Send an SMS
3) Log in with Facebook

You will now click Log in with Facebook.  You will now be prompted to change your password. Now the other party's Facebook will be removed.

Step Four: Adding 2step

DO NOT LINK YOUR REAL CELL PHONE NUMBER TO YOUR ACCOUNT. I REPEAT, DO NOT LINK IT TO YOUR ACCOUNT.
I recommend adding a GoogleVoice number to your account to avoid any further issues.
To add a phone number to your account:
Go to Phone Number under "Private Information" and type in a number that can receive SMS.

Adding 2Step makes it much harder for the other party to pullback the account.

Step Five: Revoking Unauthorized Applications

Occasionally, the other party may have an application linked that will still allow them to pull the account back.
To revoke unauthorized applications:
Visit the Instagram website and click Edit Profile then Unauthorized Applications. Revoke access to any applications that are currently linked to the account.

Step Six: Disabling Pull Back Links

This is a common way that people are pulling back the account after they receive the funds or other item being traded. Log in to the Instagram website on a mobile device, or PC. After logging into the Instagram website go to Edit Profile and click Temporarily Deactivate My Account.
After clicking Temporarily Deactivate My Account you will be required to enter in your Instagram's current password.
By deactivating the account for 48 hours or longer, all old log in links will have expired.
To Reactivate your account, you must login with your current password on the app.

Step Seven: Submitting Hacked Form Account
This form is done to validate that you have received the original email. Instagram support will not reply to you on the weekend.
To submit this form, the account you are trying to submit the form for must have touched your Instagram app in the past.

Step One: Forgot your login details? Get help signing in.
Step Two: Click Use username or Email
Step Three: Type in your username
Step Four: Click Need More Help?
Step Five: Enter your signup email
Step Six: Enter your preferred contact email (better to use signup email)
Step Seven: Click Personal Account with photos of me
Step Eight: Click My Account was hacked
Step Nine: Add any details that will help Instagram support resolve the issue faster.
Step Ten: Click Submit Request


This is where people start to get confused. Instagram support will now send you a code to your contact email's inbox. You must write down that code on a sheet of paper and submit a selfie with the code written down a sheet of paper. Within two to three days, Instagram support will reply, typically.
After receiving the link validating that you have original email, you can safely sell the username if you so choose.
After following all of these steps, your account should be as secure as possible.

Extra Info:

With Instagram's recent update you are now able to revert your username back to the old account if you are turbo'd, autoclaimed, or sim swapped.
You must have original email to successfully do this.
Step 1: Change your email on your account.
Step 2: Change your username. Once you have changed your username (if you lose the swap) check your emails inbox. The email will say "Username was Changed."
The email will say "Your username was Changed to (insert name) at (insert date and time)
If you didn't change your username, revert this change. (Will be near the bottom of the email)

Step 3: Click revert this change
Step 4: A popup will appear with the original info on the account. You must receive a six digit code from either the original email or the original phone number linked to the account.
Step 5: Enter the six digit code.
Step 6: Click "This was me." Your old username should be now placed back onto your account.

Disclaimer: Do not randomly swap your accounts. If it is on the market, do not handswap. I suggest using @Mac's swapping service. (Not held responsible if he loses a swap)