Several ways to solve this.
First, actual GFCI protection does not require a ground wire. It's better to have both GFCI and ground. But GFCI alone is still highly useful. For instance, GFCI is much better at stopping electrocutions, which is what the requirement is all about.
Extend the box
I don't like removing the box. It's delicate "dental" work and if you aren't experienced at it, you risk goring up the drywall, or worse, the old wires (and then you're really in trouble!) The original box was nailed at the joist before the drywall went up, and may be steel (and might even be grounded!) "After-drywall" retrofit boxes are plastic, hokey, weak, and clamp to the drywall... likely it'll flop around, or tear out of the wall when trying to pull a stubborn plug. No thanks. On the other hand, if you're a drywall god, then properly fit new-work boxes, but honestly I still prefer metal boxes.
So how do you make a box bigger? Here's an unrelated question. How do you attach surface conduit like Wiremold to an existing flush-mount box? With an extension adapter box that brings it out an inch or two and has side ports for the Wiremold. We only care about the first part. It's not the normal parts source, but it works.
Put the GFCI protection elsewhere
GFCI, after all, is not a socket. It is a system of protection that can protect any part of a circuit, including many sockets. You only know it from the convenient GFCI + receptacle "combo" that you're used to seeing. It comes in other forms also, such as a separate "box" or a breaker.
This will protect all of the circuit that is downstream from the GFCI. However, this itself may be a problem. If other parts of the circuit have any defects -- such as crossed neutrals with other circuits, or a hard-wired device which in fact does have a ground fault -- the device will trip and refuse to reset. Then a time-consuming search for defects will be necessary.
At the circuit breaker
The breaker version replaces the circuit breaker on that circuit, with a combo unit that is both a circuit breaker and a GFCI. It provides GFCI protection for the entire circuit. This can be expensive or impossible, depending on the model of service panel (breaker box) your home has. For instance, GFCI breakers for Pushmatic are hard to get.
This requires opening up the breaker panel and replacing the breaker. This is short work for an electrician.
Somewhere along the cable
It is possible to fit a junction box just outside the breaker panel, run the circuit's cable to this junction box, and fit a GFCI device at that location - then run a short cable to the breaker panel so the GFCI can get supply. That allows you to use a GFCI module like a deadface (which you notice looks a lot like a GFCI+receptacle combo) -- or simply use the normal combo device (if Code allows; there are new rules about bathroom and kitchen receptacles not supplying sockets anywhere else.)
Since US circuits are generally wired as a chain, another option is to find a receptacle location upstream of the bathroom, and locate the GFCI device there, wiring it it protect the downstream parts of the circuit including the bathroom.
Labeling and Testing
If you GFCI protect another receptacle, you put a sticker on the receptacle that says
GFCI Protected Outlet. Receptacles that are GFCI protected are allowed to be 3-prong even if they're not grounded.
If that receptacle does not have a genuine ground, also label the receptacle
No Equipment Ground.
The stickers are what the electrical inspector is looking for. They are not special, you can print them on a printer.
How do you do a serious test of a socket that is GFCI protected? With an external tester. An external tester won't work on a socket with "no equipment ground" and that's not a defect, that's expected. Plug it into a three prong adapter (cheater) and run a long length of wire from the grounding tab on the adapter, to somewhere you can get a solid ground. E.G. the ground bonding wire exiting your service panel.