What does it suggest about a "hack" when people I know get emails from me, but my email password hasn't been changed to lock me out? (Not a spoofed sender - I see some in my sent folder). If my password is known to the attacker, why would they make themselves known (by sending emails like that) and NOT take over my whole account?
I've changed my passwords, verified my secondary email address (for forgotten password recovery) and reviewed my two-factor-auth-app-passwords. Nothing seemed amiss. What should I look out for? I feel like since they didn't lock me out they have some other trick. This is gmail, so I have a higher confidence in their application and password database security.