You might have your Gmail already on another device, and when this pops and the log-in is originating from the North Pole, you know some shiz has gone down.
Also, it attacker wants to continue to dip into your emails and keep reading them, or keep sending spam from your account, or keep carding with your shop sites, they aren't gonna' change your password, cuz you'll contact the Googles and get your account back. Better for attacker to go slow and low.