“a password alone is rarely sufficient for gaining access to a Google account”

Link. Great article. Google essentially assumes your password is compromised.