Facebook – Someone sent a message to a friend on Facebook. It wasn’t me. Nobody else has access to the account. How

Google is probably using information that it has not specifically requested of you during the password reset process in order to verify your ownership of the account. Specifically, tokens stored on your computer, and your IP address.

I had a similar experience to yours, which initially alarmed me, and tested the above theory by using the Tor browser to perform the reset. This browser redirects a Web session through Tor's own servers in Europe, making your session more anonymous.

The result was a much more aggressive set of questions. The first time I attempted to reset the password, I just blew them off, and hit a brick wall. I tried a second time, and once I had answered the questions somewhat correctly, I was presented with an emailed link to a reset page. When I clicked that link, since I have two-step verification set up, I was presented with a demand for a number provided by the Google Authenticator app on my phone. I provided that number and only then was I allowed to reset the password.

This experience gives me more confidence in the process. Google, while fallible, is not a huge corporate playpen full of idiots. Password security is a critical feature of Google's business, and I'm sure that they have thought long and hard about how best to allow legitimate users who are schleppy enough to lose passwords to get them back without allowing thieves to run off with all the Google accounts.

Just enable login notifications. You'll be asked for a device name whenever you login. The name will be sent to your mobile (You have to activate facebook mobile for this). And once you name a device, like "Home",it won't ask again when you login from that device! Logging in from unnamed device always asks you this question. If you don't give a name,you'll get a message like,"an unknown device logged into your account at 15:30. Please change your password if it isn't you." Similarly,you'll get the message when you name a device like,"Home logged into your account at 18:00" but you'll get it only once!

To activate it,refer this!