He probably did nothing wrong at all but was collateral damage caused by their shitty "fraud" detection AI.
But at Google scale, bad things will happen.
Google serves over five-billion queries every day, and scale for gmail is similar. One-in-a-billion events are absolutely routine.
However, it’s clear they are not doing enough or not doing anything at all to remedy the problem of having a path to fix things when something does go wrong.
At Google’s scale, they should not be doing automation, AI or otherwise, without support in place when it goes wrong.
You don't even know if they clicked the "recover account" link before tweeting.