That's a bummer, I think we've all learned this lesson the hard way at least once before wising up.

Hindsight is 20/20, obviously would've been an excellent idea to enter that recovery phone or email address field. Why wouldn't you do it? In my experience, Google doesn't care how many email accounts you associate to the same phone number (within some degree of reasonability).

You know this is how it goes when you're dealing with ElGoog. Better luck next time.

Someone could've guessed your password and taken over the account, what would you like (or expect) to happen next?