There is another layer of protection you can put in place - Google Apps. For many people, spending the $10/year on a private domain with the 10 account limit w

There is another layer of protection you can put in place - Google Apps. For many people, spending the $10/year on a private domain with the 10 account limit would be more than sufficient. Allocate one of those accounts to a strictly administrative role with 2 factor authentication. That way, you can self-serve on things like emergency password resets etc.