was a while ago now, but I was absolutely amazed at how my password could've been cracked.
A spammer is just using her address as the "From" address. So any bounced emails end up in her inbox.
No one has actually gained access to her account unless it's in the recent activity list.
Just thinking about this, does you girlfriend have a mobile running android? Could be a dodgy app she has got on her phone and it's doing it that way?
This can be the case sometimes as, like the op mentioned, you can send email from any address if you know what you are doing and a lot of receiving mail servers won't notice that it's fake. But in this instance, the op stated that the emails appeared in her sent folder, so that means they were actually sent out from google's mail servers, and therefore the account has been hacked.
I had something similar ages ago, yet my password was a mixture of lower case, uppercase, letters and symbols.
Upon logging in I had a message at the top saying "Your account was last accessed from china.