Do these steps from a machine you know (know, not believe) to be secure:
1. Change your gmail password. Do not tell it to anyone. Not even your spouse.
2. Change the address of you alternate email address to an address you know to be secure.
3. Go to gmail. At the bottom in fine print there should be something that explains the latest activity on the account. It should have a "Details" link. Click it. A popup window will appear. Click Disconnect all other sessions.

After these steps:
Monitor your gmail like a hawk for a month at least to ensure there's no funny activity.

If you think your phone is compromised. Reflash everything down to emmc before you attempt login to gmail.

I am more inclined to believe that your desktop/laptop is compromised - because the n900 is not a "famous" enough target to install keyloggers / rootkits. The ROI is in most cases not worth it.

Some of these steps sound funny (paranoid) even when I read them, but for me they are important because my email account is effectively a gateway to almost everything else I have.
I cannot afford to have it be compromised.