If they are not changing regions or sending a lot of email it's also possible this is a sign that the account is compromised.
I recommend enabling 2 step logins and verifying your account information such as configured forwarding addresses and security questions & answers too: