[MereInterest]

First, recovery addresses are for recovery when access has been lost. They are an alternate method of entry when the primary method of entry has been lost. They are NOT an extra method of validation to be used for the primary method of entry.

When Google switched from offering 2FA to requiring 2FA, it would have been acceptable for them to require a second form of authentication to be added on the next log-in. It is not acceptable for Google to pretend that they have a second form of authentication when they do not.

Second, up until the moment it was needed, I had access to my recovery address. Google locked me out of my primary address and my recovery address simultaneously.