Sure, if it was me logging into someone else's account (and there had to be some conscious effort based on his random password), I'd log in and delete the email

Sure, if it was me logging into someone else's account (and there had to be some conscious effort based on his random password), I'd log in and delete the email immediately. Delete from inbox, delete from trash, refresh.it seems like you would notice that but no one spends 24 hours a day looking at their email. It probably wouldn't be that hard to slip by the best of us. That's what two factor authentication is for. And not emailing the same account for login notifications. I just don't find this to hard to believe.