I received an email from Google last night at 4:46am saying:
Someone just used your password to try to sign in to your Google Account, using an application such as an email client or mobile device.
It's not phishing, since I got a similar notification from the Google app on my Android devices.
I logged in to look for more details, but all Google showed was an unknown device, in the US (my location), with an IPv6 of 2607:f8b0:400d:c04:0:0:0:216.
I did a reverse lookup, and it seems that this IP resolves to Gmail. It does makes sense that the Gmail app on one of my devices would try to sync at that time.
I can enable 2-factor authentication, but why is Google blocking its own server?