Does this mean they had your password, but didn't have access to your Authenticator? So gmail tells you when this happens?