On: Even with 2FA, Google accounts can be hacked with ...

[decisiveness]

His recovery email address attached to the account must've also been hacked if he had two-factor on, as google always starts the recovery process from that email.