It checks for you, by the way, and will block an attempt and notify you if it looks suspicious. This happened to me earlier this month. Interestingly, that happened 4 days after the vulnerable OpenSSL version was released and my Gmail password is basically the only the one which I do not reuse anywhere and I don't know how anyone could have gotten it... Still more likely to have been a keylogger or something.