Check your account activity in gmail. At the bottom, it will say "Last account activity: XX minutes ago on this computer. Details" click on details and it will show you the last IP's to login and when it was. See if you can find out any info from that.
I just checked and it only showed data up to 4 hours ago, and the IP addresses were all me since after I've recovered the password. The attack occurred about 6 hours ago so I couldn't get info on the attacker's IP.