Thanks for everyone's input on this.

The prevailing theory seems to be that the wallet backup file sent to gmail was compromised.

The only other fact is that I did have an unauthorized login attempt on my blockchain account a few weeks back.