I don’t use GV, but presumably if they can make Google send you an auth SMS then they have already input your password. I’m guessing it was leaked in some big password leak, and not phished at an earlier time.