If they were able to authenticate to Google Search Console, it means they had, at least for some time, control of your website.
If the hacker were any good, they would've immediately setup an alternative access to get back into your site (perhaps a backdoor of sorts, preferably not easily detectable).
I have seen at least once instance where the hackers took control of a website, posted viagra ads, uploaded click-fraud code and even hosted malware for some time on the site. For that period, they used blackhat SEO techniques to promote the site (specifically the links they wanted) - which was how the Dentist (the victim) found out about the hack in the first place. A friend asked him why his site is in search results for the oddest things.
But almost everyone knows that Google will notify the site owner when a new email is added to site management - so in your case it doesn't make complete sense, but hopefully my answer will give you something to start with.
PS: You should look for what else the hacker could've done while (s)he was in control - especially alternative ways they can keep getting back in. If you have a way of logging events remotely, that's a great thing to do, even if it is a tad late now. You will come to know what the hacker is doing on your site if/when they return.
PPS: My product ActiFend was made for a different purpose, but it can do remote logging + we have security analytics dashboards internally; so if you are unable to make progress, let me know (through the app or just write to support at actifend dot come) and I'll see we can use our chops to find any elusive needle for you. This is just out of my curiosity, so no purchase needed. :)
