Thanks guys, I do still strongly suspect it was him, though it seems quite clumsy to hack someone in a way that allows them to see your own emails, though maybe he didn't realise that.
I have put on the 2 step verify and changed my passwords.
I am still considering whether or not to report it, I have generally found reporting things to the gardai to be useless and stressful, like they interrogate you before they do anything.
But in general the things that make me think he was spoofing about the phone being stolen are:
the my device app used to lock the phone shows the make and model, so he thought he could use that to make up that story.
Didn't lock the phone until I contacted him despite it supposedly being stolen years ago (and of course it happened in Limerick, to make it more believable ad Limerick has a bad rep for being rough). My phone was bought brand new so it would be unlikely to be his phone it wasnt from a CEX or something. I asked him did he have the imei of the phone, of course then he said no, that he bought it secondhand from his girlfriend.
Didn't contact me when I sent the emails which were polite and helpful, other than to tell me to kill myself and lock the phone.
Then, once I sent an email letting him know that I had his personal info, suddenly he gets in touch.
What makes me want to report it though, is that the unrecognized device sign ins sent to his email could suggest he is hacking into other people's devices or accounts. When I reset the phone and got my account back up and running, I no longer had inboxes other than primary and all the emails to this other address were gone, so he covered his tracks quickly but I had already found his name and facebook profile.
Still can't find anything online where someone was able to basically merge two email addresses like that, it doesn't seem to be a popular hack. But locking people out of their stuff is popular and the message is very much like something a troll hacker would send.
When I asked him why he didn't lock his phone after it got stolen, or why did he think anyone who stole his phone would send helpful emails ages later, he had no answer.
I have several emails now from this guy as we messaged back and forth a good few times, which show his full name now that match the other emails sent to him, but no longer have the emails that I was able to view that were sent to him like the sign in attempts, so not sure how much proof I have, but in the emails he does admit to sending the message and locking the phone. Luckily I don't really have any online banking acts and my passwords are all different.
I'm going to try and see if google can help but I find it can be hard to get any joy with these big companies.