A former member of our team who originally had our Google account password keeps trying to modify the password and it succeeds! I think he uses the password recovery feature and succeeds in his intent by entering the creation date of the account to verify it, but he should not be allowed to do this and he's causing problems to our current team. He then not only logs in, but also changes the recovery email to his one, the recovery telephone number to his one, etc!! This is crazy... This is happening daily now and we need to find a way to permanently lock him out. We also enabled the 2 steps verification with the same results... Today we added the Google app verification (with an iPhone device of one of our current team member) hoping this will stop the problem showing a notification on the phone regarding the 3rd part attempts and being able to deny them by answering "NO" in the phone Google app popup.
But anyway we wonder if this is going to happen again... What can we do?