On April 4, I got a notice in my Gmail that there was access to my account from an unknown IP in a far away state. Changing my password was suggested. Although the original password was quite complex, I changed it and set up two step verification. Inasmuch as Android phones are not set up for two step verification, a sixteen character password was generated for me to use on my phone for gmail access. Then on April 6, my gmail account was accessed by essentially the same IP address (+1), in spite of the two step verification process. So I turned my suspicions to an app in my phone.
Astrid has become my primary suspect, since it has permission to access my Google calendar. No other app has access to any of my Google stuff.
I have deleted Astrid, changed my password, and changed the 16 character code supplied by Google. Time will tell if this does the trick.
Has anyone experienced Gmail access from an unknown source using Astrid or a similar app?
EDIT 4/10/11 If I determine the cause of unknown access to my Gmail account, I'll certainly update it here.