The bug allowed a researcher to uncover recovery phone numbers of nearly any Google account.