It definitely would be interesting know details. SOmeone using my account for spam was first thing I suspected as well, but at least the Google login history does not show anything out of ordinary, all my devices from locations I know with timestamps that I can match with something I did. Also the account has strong password with 2FA enabled, which I assume should give some amount of security.