At the bottom of the gmail page, you will find text like: "Last account activity: 40 minutes ago at this IP (201.82.153.204)." followed by a "details" link.
Click on the details link, and you will see the last IPs from which Gmail activity took place.
You will also find a "Sign out all other sessions" that might be useful if your account was compromised - even if you changed your password, if someone was logged in already he will not be suddenly logged out - so he might still retain control of your account.
The easiest explanation for that behaviour is that you have either forwarding or POP/IMAP enabled and have a client running somewhere you've forgotten about.
You're absolutely right. I set up a mail client to download mails weeks ago and it was downloading them 1 at a time (seems like a server limitation), so it wasn't a problem until today, when it downloaded first unread messages ever. I didn't suspect it because it's been operating for weeks in the background and didn't cause any problems.
Click on the details link, and you will see the last IPs from which Gmail activity took place.
You will also find a "Sign out all other sessions" that might be useful if your account was compromised - even if you changed your password, if someone was logged in already he will not be suddenly logged out - so he might still retain control of your account.
Good luck.