It may be too late for the original poster, but...

I suggest everyone associate an alternative email address to their gmail account as well as your mobile phone number. If someone tries to recover or change the password it will sent you email and SMS asking for your permission, and if you ignore it then they are stopped in their tracks.

I get these alerts regularly.

Gmail also has "unusual activity alert", for example if all of your normal logins are from Germany and then suddenly there is a login from China it can text you to warn you about it.