> The hacker changed my gmail settings to mark all security messages from Google as spam

The fact that this is possible is a weakness in itself.

Google security messages should be signed and treated differently by the client & server