It seems like Gmail isn't logging full account activity. Recently I had my online account to Paxful hacked.
Today, 11/27 at 5:07, I received an email from Paxful saying that someone requested a password reset link, and at 5:08, another saying that my password had been reset from an IP address registered to a company in Amsterdam, but showing a geolocation in Chicago (18.104.22.168), implying they had clicked on the email link.
I then accessed my detailed Gmail recent account activity, and there were no logs of logins to my Gmail account during that time, 100% positive.
How is this possible? There's no way to reset the password outside of accessing the email. Doesn't Gmail log activity?
Paxful email header:
Message ID <email@example.com> Created at: Mon, Nov 27, 2017 at 5:07 PM (Delivered after 28 seconds) From: Paxful <firstname.lastname@example.org> To: (hidden)@gmail.com Subject: Password reset at Paxful SPF: TEMPERROR with IP 22.214.171.124 Learn more DKIM: 'PASS' with domain paxful.com Learn more DMARC: 'PASS' Learn more