I have an many Gmail accounts and I've never had any issues like this. I created a new Gmail account for a new website I created. It has the same name as the website, e.g. something.com and firstname.lastname@example.org
Its password has been compromised twice in the last two weeks. The first time it was compromised, I changed the password to something that is over 40 characters long and contained every type of character in it. Yesterday evening, it was compromised, too. The problem is if the most powerful supercomputer were to make an brute force attack, it would take forever for it to guess it right, assuming Google doesn't stop it from making trillions of guesses every second.
What's even more confusing is that I created the account a month ago. It receives no mails whatsoever, and no human or machine knows the address of this mail because I never used it for anything. It just exists there. There are two machines that were logged in to it: my desktop and smart phone. My desktop does not seem to be compromised in any way. My smart phone is outdated, and does not receive any more OS updates because the hardware is not capable of running the newer versions. I am also logged in to all my other mail account on this phone, but I did not have any problems with the others security-wise. I also did not enter my password anywhere except when I was alone in my room, so it is not possible for anyone to see me entering that password. I only entered it once, when I changed my password two weeks ago anyways.
The login attempt seems to be made from US according to Google, but the IP address' origin seems to be Brussels, Belgium and it also looks like the IP belongs to Google. The following are two IPs that Google informs me of:
My question is that how in the world they knew what my password was? Could these be fake warnings from Google, just to get me to change my password?