Keylogger from Runescape scam? Very concerned!

A Java exploit is possible, but if you are using Mountain Lion and run Software Update, that should rule out that possibility. I assume Java is enabled in Safari, but if you do not require Java then disable it.

I know of no Mac keylogger apps that would not require Administrator access to install. All the Runescape scams I have been able to determine attempt to deceive you into installing software through social networking.

You also need to answer Linc Davis's question about Safari extensions that you do not recognize - Safari menu > Preferences > Extensions.

It looks like this:

What do you see there?

I'm not sure what a Safari extension is

Select Safari ▹ Preferences ▹ Extensions from the Safari menu bar. If any extensions are installed, that's where they're listed. If the list is not empty, there anything in it you don't recognize?

Java is enabled.

Java should always be considered untrustworthy. Unless you have a need for it, disable it. No Java exploits are known to be circulating at the moment, but I can't promise you that you're not among the first victims of a new one. If you are, then what will probably happen is that it will be identified by security researchers and Apple will then (after some delay) issue an update to remove it and the exploit that enabled it to be installed.

But it's overwhelmingly likely that you don't have a keylogger. Nobody would go to that much trouble just to steal passwords for a game site. The likelihood is that the game vendor's server was hacked -- a common occurrence, unlike client-side Java exploits, which are relatively rare. The post on the message board could be a hoax, or it could be someone trying to deflect blame.