I'd start with ensuring the phone number is correct, the backup email address is correct, and adding TWO u2f keys. One for normal use, and one as backup. You

I'd start with ensuring the phone number is correct, the backup email address is correct, and adding TWO u2f keys. One for normal use, and one as backup. You can have google remember your often used desktops and only require u2f tokens/dongles for new logins. That way your account is less likely to be stolen and if it is hopefully you can trigger a recovery before all the recovery methods are wiped. If you want to be proactive, google has an interface for "recent activity" that includes IP addresses. Guess you could scrape that regularly looking for suspicious activity. But the only safe thing to do is register your own vanity domain, point it at google, and keep your account/contacts backed up. That way is someone steals it you can just repoint your account to a new gmail, restore from backup, and move on. The important thing is to never give the @gmail.com address to anyone you care about communicating with.