It's occurred to me more than once how stupid Google is when handling logins from new devices. It just sends you an email like "hey we noticed a login from a new device, was this you? yes/no", as if an intruder couldn't easily just click "yes". Doesn't even require you to answer a security question or anything.