We use GMail for our business email, we are a small company. I do the mail administration for our domain, and I was recently alerted by an email from Google that a colleague's account had some suspicious logins and was suspended.
Looking at the login audit report for this account, I can see that there have been about 27 suspicious logins over the past approx. 3 months, the first being on July 28 2015.
He unknowingly continued to use the account throughout this period right up until Google suspended it yesterday. We changed the password and enabled 2-factor authentication (in fact we've made it company policy for all staff). We then followed Google's checklist for administrators: https://support.google.com/a/answer/2984349?hl=en
I've been doing reverse lookups (ping -a) on the source IPs of the suspicious logins as recorded by GMail, and I'm getting a variety of rather concerning top-level domains returned e.g. .ru, .pl, .ly, .kg, .kz, .mx, .ar, .eg, .br, .tr.
They mostly appear to me to be residential ISP subscribers on dynamic IPs using DSL or similar.
He remembers having some temporary trouble receiving email around the time of the first suspicious logins, but we've noticed no other obvious suspicious activity in his email or any of his online services since then. He uses Outlook on a laptop to access GMail via POP3. We are not sure what vector was used at this stage. He did do some travel within South Africa around when it started, using hotel Wi-Fi, but he has never been to any of these other countries.
What I'd like to determine is:
Given the pattern of suspicious access, what was the likely mechanism? E.g. were the unauthorised logins from individual hackers who were sharing my colleague's logon credentials, or were the source IPs likely to have been users unaware that they had malware on their machine sending spam or similar?
Given that we are a software company that authors and administers websites, but has no reason to believe that any of our production hosting infrastructure has been compromised, what further action should we take, if any?