... I was told my account had been accessed from an atypical location 1 day ago. The next thing I saw was that it was accessed from ductus.com (WA)...
... The best answer is that this is a false alarm. That's bad enough.
The less best option is that either my Google password has leaked or Google has a global security issue. A dictionary attack would be unlikely to work on my prior password. The tucows domain would then have been a hacked attack vector....I'm looking for other reports like mine.
Update 10/13/10: Yes, it was.