@cshirky @haroldthimbleby 2fa does indeed cover that case, because without 2fa, the attacker can't get into gmail to turn on forwarding, unless I am not following?