What to do if you suspect your account has been compromised

Please contact [e-mail] immediately and tell us that your account might have been compromised; don't wait to give us details. We will lock your account immediately to prevent abuse and sort out the other issues later.

If you already configured two-factor authentication, a compromised password (e.g., by somebody watching you type it in) is no big deal, since your account is still protected by the second authentication factor. Nevertheless, please change you password (on the Google Account web page) in this case as soon as possible.

And please, remove that sticky note with your passwords from your desk.