you have the right idea. since the elements of S do not equal there own inverses, elements of S occur in G "in pairs" {x,x^-1}.

by pairing every element of S with it's inverse (which must also be in S, right?), if we had an odd number of things in S, we would wind up with "one left over".

but this one "left over" would then have to be its own inverse, a contradiction.