Those are very general questions, so I can only give a general answer. Security can be evaluated in the context of a concrete threat model.
Does anyone know if there was any study done on the security of GAE in comparison to other servers for web apps?
http://scholar.google.com is a good source of scientific papers.
What would you say are the most likely weak chains in creating a web app on GAE an handling users' valuable information?
The typical weak link of self written web applications are query injection, Cross Site Scripting and Cross Site Request Forgery.
Google does support a secure authentication service which can be used by app engine programs, which prevents many common mistakes.
For example, is the web app only as secure as the web admin's password
Yes, like a chain, the weakest link defines the overall security.
Or can there be some other security measures in place to prevent even the admins from accessing users' information stored with the app?
Since client side encryption is not feasible for web applications that are targeted at ordinary users, there is no way to protect against malicious manipulations of the web application done by the admin.
Furthermore it means that any information you store is accessible by Google, since they have both access to the data store and the application code (which might have hidden encryption keys).
Especially the last point is a huge issue, if European privacy laws apply to you. Google was forced to admit that they handover information stored in Europe about European citizens if asked by the US. The problem is that this illegal activity (see green box) by Google might cause legal trouble for the person or company using Google Services to host customer data. It is the responsibility of the company collecting data to ensure that contracted service providers comply with European law. (I am not a lawyer, so this paragraph is only as far as I understand it).