If he had any purchase history, address, real name (combined with govt ID), or phone number in their account history perhaps those would be means of authenticat

If he had any purchase history, address, real name (combined with govt ID), or phone number in their account history perhaps those would be means of authentication? Authenticating the true owner of a hijacked account is hardly impossible or even very hard. Google knows who people are without them even having to log into an account from their relentless hoovering of data.