Google now offers a security checklist for Gmail users, a five-part process with multiple steps in each designed to reclaim the feeling that nobody can get into your inbox. It starts out obvious (security updates, plug-ins, passwords) then gets into trickier tactics.
It's a good link to dig into if you feel like you've let your security situation sit untouched for years, or for forwarding to anybody you just know is one script kiddie away from sending out emails to everyone about herbal remedies. Once you check off the basics, you move into confirming the sites authorised to access part of your account, looking through a log of recent activity, and setting a default encrypted connection for the account. All good stuff and worth the small time and effort.