a typical case for users who forgot the password as it has been saved on multiple devices and no longer needed for signing in, hence no longer cared to associate cell phone and/or 2nd email address until the incident occurred. the same story repeats everyday and everywhere.
> Does the user having anything that would be tied to the Gmail account, like an Android phone?
yes, one mobile device still receiving messages from the account to be restored.