There are some interesting wrinkles to this kind of scenario though. For example, using password dumps it's pretty easy to find large numbers of account creden

There are some interesting wrinkles to this kind of scenario though. For example, using password dumps it's pretty easy to find large numbers of account credentials which work to access email accounts (by stuffing u/p from breached site into email provider). Knowing u/p of an account is a weaker signal of ownership than it used to be. Particularly if the account is old and has a weak password. Although OP didn't do it, buying up defunct domains used for recovery emails and taking them over also removes any "proof of ownership" value that the recovery email is supposed to provide. Anyone can do that and it's an exploit of an imperfect process. The OP is secure in the knowledge that they own the account, but from a process point of view the provider does not believe they have strong evidence that is the case. The security landscape, technology and defense measures change over time, and I agree it sucks that the OP can't access their account due to factors outside their control. P.S: Were the credentials on your gmail account ever disclosed in a breach? (e.g is the password on haveibeenpwned).