If I were the owner of the gmail account in question, and I were planning to sell or otherwise misuse the bank's customers' information, I would certainly reply to the bank and claim to have deleted the file. In fact, I would actually delete the email, but I'd have already transferred the data to some very heavily encrypted storage elsewhere(deniable encryption, of course).