1
I ended up just changing their password, removing their recovery phone number and email, making sure that 2FA was disabled, and removing any devices that they had linked to the account.
As far as I know that has completely locked them out of the account including resetting/recovering the new password.
Then I logged into their email and setup forwarding to ...
Only top voted, non community-wiki answers of a minimum length are eligible
