This is the most common and happens all the time. If someone just wants to send SPAM, it makes no sense to try and attack Google's servers because they're going to be more resistant than most and certainly infinitely harder than an open relay somewhere.

That said, I use a different password for every site, always at least 10 characters long and always a mix of letters and numbers, with the letters being a mix of both upper and lowercase. Further, if I were held at gunpoint, I would not be able to divulge my passwords because I don't know any of them myself.

Of course open relays and easy to compromise mail servers are going away, plus often find themselves in black hole lists, so there's some motive to relay through GMail if possible. Their size and popularity (and acceptance) just make them the most visible target.