They could just verify he knows the old password and controls the old phone number, and probably also has devices logged into or connected to the account.