Sounds like he has an alternative means of identity verification (SMS) but Google keeps only working with the locked email address.
I mean, Google could also do what other companies do and let you send in a picture of your ID or have you enter identity questions.