One thing that I don't see mentioned: The attacker doesn't need to know the victim's email address or even name, if they have a compromised phone number. If yo

One thing that I don't see mentioned: The attacker doesn't need to know the victim's email address or even name, if they have a compromised phone number. If you go to mail.google.com and say "Find My Account," you can enter a phone number directly, and then proceed with SMS-based recovery, if it's enabled. This means that any time an attacker gains access to a phone number, they can plug it into gmail and fish to see if they can break in to an account.