Hello!
Yes, you can use the "command + r" when starting up your mac to enter recovery mode and then open the terminal application and use the "resetpassword" script to reset an account password. One way to stop this is to turn on filevault on your computer. This will encrypt the entire hard drive and require a password before the computer will boot up. One other thing to note is that if you are signed into your iCloud account on your mac and have "find my iphone" enabled then you will be able to track and remotely lock the computer regardless of what is done in recovery. This is because the serial number for the device can not be changed and remains attached to your account unless you remove it.
For more information about FileVault check out the following link:
https://support.apple.com/en-us/HT204837
Let me know if this helps!