Why can't you block all access to your account from outside specified regions? That would be an obvious first step. Sure the hacker can use VPN, but once Google learns that all of the attacks are coming from a specific VPN they can block it.