I'd guess his mail account got compromised. It's simply the biggest hole you can get through. I guess it's futile to discuss what is 'probable' because why would someone do something improbable - because it is improbable. Circular logic, we'll have to wait and see...
Is 2FA disabled when you request a new password? I don't think so.
But in case of Google Mail you could have control over the 2FA authenticating entity...