> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email.

Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the same thing with an <img> tag, access the image data with JavaScript, send it back to the server and compare if the contents are the one you shared.

I do not have a gmail account so I don't know if this is possible, it it seems like it would be possible for Google+ from briefly looking at it.