@briankrebs thanks for clarification! I tried to replicate this beforehand, but in my case it asks for password, phone number, auth or recovery code. If it works without any of these then it's highly disturbing.

@briankrebs "In reality, the thieves caused the alert to appear on his phone merely by stepping through Google’s account recovery process for Griffin’s Gmail address." Does this mean they had his password or auth code? Recovery notification couldn't be sent otherwise.