Gmail – If someone hacked into the Gmail account, wouldn’t that let them go in and change the recovery email all together

See additionalemail@gmail.com is an alias for realemail@gmail.com, which implies that addtionalemail@gmail.com is something like: real.e.mail@gmail.com re.alemail@gmail.com or realemail+anything@gmail.com

This is not a separate GMail account and so you cannot receive separate emails for this. You do not have a separate inbox for this. You can create a filter so that the emails sent to the additionalemail go to a particular label.

You can try creating accounts on different sites using additionalemail, you try to subscribe to something using this additional email.

If you go to GMail>Settings>Accounts and Imports you can add additionalemail under the Send Mail as and send e-mails as additionalemail (but the complete header of the sent email would reveal your realemail@gmail.com).

Trying to do it within the web app will be very painful.

The way I would attack it would be to install an e-mail client that supports IMAP. (Thunderbird, perhaps.) Then set up both accounts in the e-mail client. Then, when they're all synced, use the client to copy all of the messages from one mailbox to the other.

You can delete the client software after that if you don't want to use it.