1/ SSL is always used by Google when authenticating, in other words, your password is never sent out in clear.
2/ The same is true for the N900's connection to Google. I remember, at the early days of GMail, it being such a pain in the *** because they required TLS and the lot.
3/ You probably used the same password somewhere else.
4/ Don't blame the N900.
5/ Stupid topic
6/ ???
7/ Profit.