In just one of multiple Gmail accounts on my cell phone, I noticed that an outgoing email sent while away from home (probably over 4G) got stuck on the Outbox without being sent. At first I attributed it to cell phone data coverage issues in the area I was in, but even after connecting to WIFI it didn't send.
When I tried to sort out what was going on with that account, it prompted me to verify it, and didn't recognize the password, having to enter a new one after typing the one that I thought was still valid to verify my ownership of the account. After that everything was good until it happened again twelve hours later (and again, everything went back to normal after changing the password, which at this point, I have changed multiple times from a PC to try and avoid being tracked).
None of the interfaces seemed out of the ordinary within standard routines within Google. The other email accounts worked without a glitch on the same phone.
I don't use 2-step verification for this particular account.
I looked for any POP or forwarding, or other sharing settings that could show that the account was compromised, but everything was fine. And I looked under the account activity, and all the changed password events were done by me.
There was only one thing unexpected under the Access tab: an address from out-of-state that I couldn't reverse ID:
Mobile United States (PA) (2600:1002:b117:ccd7:e506:e318:fc5c:a2cf)
I don't recognize this address, but it doesn't show like there was any password change done by this address, and there were no emails sent or received during that time. Critically, I did not received any notification of an unrecognized new device logging on to my account, and all the devices listed as having accessed my account are mine (under a separate tab in the Settings - not in the list of recent activity, where this IP address appear). In terms of the time, I could have accessed the account from my phone, and only from my phone, which appears elsewhere but not in that entry. One option is that the IP address changes when not using the home network WIFI - so it was possibly my activity using cell data. But that doesn't explain why I was prompted to enter a new password.
I checked my android for malware with no returned flags.
What could be going on? If the account was compromised, how can I prove it, and how can I find out what sort of access the intruder could have gained? And are the steps I took good enough?