Here is how: whenever login happens from PC with not correct/current cookies, unknown IP, or whatever other indicator send an email with link to login page. Unless email is compromised link should point to real Google login.

Unless attackers compromised your email they will not be able to obtain secret picture.