@Yaakov Ellis: "In order for your phone to access gmail, you create an application-specific password in your Google account." Which solves a *part* of the problem: the attacker won't see any *new* e-mails. However, most mail clients will keep a local cache of the e-mails, so your e-mail history is compromised one way or another.