Should the last operation by the old-timer system developer be "(this_month XOR last_month) AND this_month" instead of "(this_month XOR last_month) XOR this_month" ? Or am I missing something there?
Google sends the recovery information related emails on the recovery email address. So they won't be going to the account that is not accessible to you (I prefer to say that instead of hacked). And the link to cancel the request is indeed a good idea, because if someone else submits a password reset request, then you must be able to cancel it because you did not initiate it. Otherwise, you will end up losing your account to the real initiator of the request.