All you need to know about Google's login history:

https://support.google.com/mail/answer/45938?hl=en

(but as they said, if they used your computer, then that's no good, or if Paxful got compromised)

Also, could the Paxful email be a phishing one? maybe the links sent you to a similar webpage / or one on Paxful that got HTML injected to it, to steal your Paxful credentials?

As you said, 2FA (/MFA), for the win. But make sure you have those 2FA keys on more than one physically secure site, something like your wallet and your place at home to keep stuff safe should suffice.