PS: Are you using "2-Step Verification"? https://www.google.com/landing/2step/#tab=how-it-protects This at least would explain how they detect your device, but then somebody knowing your password can't access your account.