From all of these suggested possibilities, I do admit I saved the seed in my google drive. To access my gmail account though, requires 2FA. Google did not notify me for a remote login etc. I used the same seed since 2017 on the same ledger device.
If they did get access of your computer then they've probably spoofed your email to somehow circumvent the 2FA, it's not a new thing, a lot of hackers use that to try and bypass 2FA and if they're able to do that then you wouldn't notice that they've logged in. Plus, you have a physical device so it's much more difficult to access your wallet in that manner. Can you show us the transactions?