If he had any purchase history, address, real name (combined with govt ID), or phone number in their account history perhaps those would be means of authentication? Authenticating the true owner of a hijacked account is hardly impossible or even very hard. Google knows who people are without them even having to log into an account from their relentless hoovering of data.