[nulbyte]

>> Enter the last password you remember using with this Google Account

> Which of course the attacker knows because they changed your password.

The site asks for the last password you remember using, not the last password that was used (presumably by the attacker). I don't think this is as bad as you think; the attacker doesn't likely know the previous password, or else they would not have needed to hijack your phone number.