It's actually ridiculous the byzantine methods sometimes required to regain access to Google accounts. To even have a chance in such cases—even when a recovery email has already been configured—one has to use the exact browser version number that has been previously logged into (how many users would even note this), same geographic area even if different IP (obvious), and importantly if prompted for a phone number not to use one that has been used on 2-3 other accounts (even if only used to login and not entered as the recovery or 2FA number).
The last straw that prompted me to leave them was when they began asking for a home address. Just voluntarily after successful logins and not part of any forced login or security requirement. The audacity that they expect users will just give it to them was so offputting, apart from everything else they try.