I mean, this is just my guess; I could be wrong. But the vibe I get is that you basically have to do something non-trivial via the web (log in, create something, delete something, whatever) to show that a human is paying attention to the account and not just an automated system. Don't rely on automated means like IMAP, regardless of what actions you're performing with those.
I assume it’s tied to logging in or using the account while logged in. Email is a separate system, it’s possible they linked up the email system to the accounts system, but the easiest way to implement this would just be to update a timestamp every time someone logs in or makes an authenticated browser request.
> but the easiest way to implement this would just be to update a timestamp every time someone logs in
You don't have to speculate here. They clearly say "Activity might include these actions you take when you sign in or while you’re signed: Reading or sending an email, Using Google Search, etc."
