Keep your account locked down and decide what reaches your inbox.
Use at least 8 characters. A passphrase is easier to remember and harder to guess.
A second step at sign-in, using an authenticator app.
Codes from Google Authenticator, 1Password, or similar.
Devices signed in to your account. Revoke anything you do not recognise.