That's why the second step shouldn't be the only phone with the account. She can go to Google and try the "forgot my password" link, but if the only place the email account is on is the phone, she taped dynamite to her leg and lit the fuse.
As Almeuit said, Google is about the only place that
might be able to help her. In the future, don't have the phone using the account as the second step and the only place the account's email goes.
(And get a password safe -
Keepass2Android Password Safe has a Windows version too, and the data file can be kept on Google Drive, so everything has access to the same passwords. If there's a second step, put that into the comments. LastPass is also good, but KeePass is free.)