Distributed password guessing via a botnet with tens to hundreds of thousands of IP addresses would be one possibility. Keep the guessing below the ban thresho

Distributed password guessing via a botnet with tens to hundreds of thousands of IP addresses would be one possibility. Keep the guessing below the ban threshold and you can brute force an account's password given enough time. This assumes Gmail only does IP rate limiting for login failures and doesn't impose any per-account restrictions, which could lock the legitimate account owner out in the event of an attack on their account.