This is a security feature of Google called factory reset protection. As far as Google is concerned, the phone still belongs to the person who last had their Google Account on it. (aka boyfriend). What should have been done was 1. unlock the device and go to Accounts, then remove Google Account and add your girlfriend's Google Account. Not only will you need the ex boyfriend's email, but the current Google password as well. The best thing to do is to try to contact the girl and see if her ex-boyfriend is willing to help.