His recovery email address attached to the account must've also been hacked if he had two-factor on, as google always starts the recovery process from that email.