Knowledge about items on the inbox/address book
Location of devices used to access the account
Knowledge of past passwords
Not sending password reset emails to secondary emails that have just been added
I've had more than one job that uses gmail in the office, including my current one. My boss's account is presumably authenticated and if I bugged him he would vouch for my identity.
I have correspondence with a bunch of people in my google account going back years. I could bug any number of them to vouch for me.
I've had, in the past, a few work accounts that used google, that mad my picture associated with it. I can do a google hangout to show that that is still my face.
I have a driver's license with my real name on it, which matches my google account.
I control the phone number associated with my google account.
. . . A hacker could compromise one or two of those, but it would be hard for him to get a majority of them, even if he had my phone and email in his control.