Gmail Security – Does Unusual Activity Mean a Successful Connection?

I have not seen this, but I strongly recommend adding 2-factor authentication to your Gmail account to make it more secure.

It will add a second "password" used to approve new devices you login with, via a phone call or text message.

@david, I'll rephrase your question:

• How did someone get access to my contacts?
• Do they still have access?

@Al E. made some great suggestions about how the attacker may have originally accessed your contacts. Many apps and extensions have broad permissions that could put you at risk if one of those third parties is infiltrated, compromised, or just plain malicious. You should certainly carefully review your data exposure to those third parties. Or it may have been a virus (especially a keylogger) on a computer that you signed into at some point.

To the second question, I doubt the attacker still has access. The recent nature of the sent spam emails could be coincidental, and doesn't necessitate an ongoing compromise. However the attacker originally attained your contact list, he may have saved an offline copy, allowing him to send spoofed emails even if he lost access to your account after you changed your password.

So a third question presents itself - what should you do now?

1. Turn on 2-step verification for your Google account to prevent future compromises. Even if the attacker is using a keylogger, each 2-step code can only be used once. This will make your account far more secure.
2. Run antivirus scans on the computers where you regularly log in, just in case (a little paranoia never hurt anyone).
3. Using the email headers (and optionally, MXToolbox's very useful SMTP parser), determine if the source IP addresses that the spammer is using are on a spam blacklist. If they are, many of the messages probably aren't making their way to your contacts. Sigh with relief.
4. File a case with Google (see here for details) so they can investigate the issue.