Why do you suspect a breach and not someone that knows your phone number and gmail address? They can try to log in as you, triggering the 2FA message to be sent and then send you the reset message with sender spoofing.