My impression is that these hackers would have much of the scamming process automated. Maybe it was a real person filling out the recovery form, but I doubt the

My impression is that these hackers would have much of the scamming process automated. Maybe it was a real person filling out the recovery form, but I doubt the initial scheme (set up redirecting, send spam mail) was performed by a human. Perhaps the hackers had saved every email in the account and were able to extract the necessary information to do the recovery. But the author admits the Gmail account isn't valuable - the marginal gain from recovering the hacked account seems negligible for the hacker to intervene himself. It seems more plausible that the recovery form has been gamed. The initial hack was programmed to extract the information in advance and possibly even perform the account recovery if necessary. They know exactly what and how much information is needed for Gmail to accept the recovery, whereas the author had to call his s.o. to fill out all the fields. Either way, it sounds like the Gmail recovery form should be revised. The author argues recovery is already difficult for the true owner to perform. Google could, while keeping the automated process, make it harder for an algorithm to recover the account than the real owner.