I’m afraid someone has been secretly accessing my google account

TLDR; creepy dude who had a crush on me hacked my google account to stalk me. When I realized, I logged him out and changed the password and forgot abt the entire issue for the past few months. Tonight I saw that a document from 5 years ago was just opened at 4:30 am when I wasn’t even awake. Very very concerned and I have some questions at the bottom. Thank you for any help in advance!!!

I’m in high school and our district issues all of us a standard google account. I have a ton of documents and emails that contain lots of private information on it, and it basically contains everything of any importance from my entire academic career. Starting in August, I got a weird notification that a new device just logged into my google account, though I wasn’t anywhere near a new device, nor had I been for the entire day or so. I kinda brushed it off until I went to my drive later that evening to do some school work. But as I went to my recents, I noticed that some documents that I haven’t opened for literally years had just been opened that day. And the time they were opened was when I was at school, obviously not on my drive. I then developed a strong suspicion that it was this creepy guy who graduated last year that had a huge crush on me, but I had no confirmation until GET THIS on my recents there was a pdf of the map of the college he is attending that was opened that day. And I 100% never would have tried to open that map nor would I have any reason to. I was now 99% sure it was him. Then I went to my security settings and looked at the new device that logged in. I figured out that google provided the IP address of where that device was last used, and it was in the city that this college is in. And finally the most incriminating piece of the puzzle, when I enter the ip address into an online tracker, it returns the exact location of his college and the WiFi network is that of the college’s. Even weirder, when I went back to my drive the map of the college was deleted. I told my mom and she told me to change my password, which I did, and I also signed out his device. I figured if he ever logged in again, I would be notified, so I left it alone. But just an hour ago I saw that an essay I wrote in freaking 8th grade (I’m a senior now) had been opened at 4:30 this morning. Not only did I forget that this artifact even existed, but I wasn’t even awake at that time. Now I try to do the same tracking process, and I realize that under my signed in devices there is a model of computer that frequently signed on that I never used before. I tried to track the IP address, but google would not show it to me. It’s so weird that I didn’t get a notification for this device, so I wonder if he found a way to bypass it.

Anyway, my questions are as follows:

How did he sign in if I changed my password and signed out his device?

How did I not get notified of this new device?

How can I prevent this from ever happening again? Keep in mind that I can’t simply delete this account since I rely on it for school on a daily basis.

Thank you so much!!!