The Google support people should have mentioned it, but hopefully, they wouldn't be able to tell him the password without investing tens to hundreds of thousands of dollars in cracking the hash.
I'd hope the phone tech support understand the goal was to regain access to the account, through a reset or whatever mechanism, and not to just know the password. But maybe if my dad worded it like I did the same confusion could've happened.
We're talking about giving out a forgotten password, not getting access to email contents.
I used to work on the indexing system, not GMail, but my vague recollection is there are some master private keys (necessary for lawful intercept, etc.) locked in hardware modules for email storage, where very few binaries are able to get the hardware modules to perform public key decryptions. There are strong safeguards on humans using some of the binaries that do have access. Access to these encryption keys is orthogonal to access to the account password. My recollection of the Aurora attacks is that the intruders got access to some systems that were able to decrypt/display senders and subjects, but we believed they were unable to get at the email bodies.
They can do a password reset, however would need sufficient proof of account ownership. Having access to the account is unfortunately not enough proof to show ownership, as that could be achieved with access to someone else’s device.
If it was, then someone forgetting to log out on a machine they didn't own could be a much more serious problem than it is. Rather than just temporary access to the account that the true owner has the ability to revoke, it could result in a completely stolen account.
And I have a theory. My theory is they did the risk benefit analysis of all this and decided this was the best way to go. I think the the hole that opens up when you are open to appeals and special cases is too great, the bad press from one bad case is so bad that it's ok to ignore all the folks who have lost their accounts. I mean, what other explanation, what other reason can there possibly be for this?
Edit: also consider setting up a mail forwarder to another address you own if you can from the app UI, I would do this on a test account first in case it forces you to reauthenticate, as it can be a suspicious action.
[edit: I wonder how many of the down voters have actually sent email to a government agency using Gmail or dealt with some of NSF email issues firsthand?]
I just had the same problem with my dad and even though he can send and receive email from his gmail account they still won't tell him the password. All he has is the fragile oauth token on mail.app on his apple smart phone that can only connect via wifi due to the loss of the old phone number.
Additionally, my mail from my independent mailserver just started being marked as spam by google (exactly when I sent mail to noaa.gov and fireeye's internal system was borked due to their solarwinds problems http://superkuh.com/spf-google-fuckery.txt). I signed up for google's postmaster tools set my DNS TXT records but apparently I don't send enough mass mail to not be a mass mailer.