Yes, Podesta asked an assistant to investigate whether the email was for real. She did, and was provided a NON-PHISHING link to change the password. See link.
https://www.cbsnews.com/news/the-phishing-email-that-hacked-the-account-of-john-podesta/
No, the claim of an "attempt to use it" WAS the phish. There was no attempt to use it, just a claim that it had been used. The google return address was bogus.
That's possible, yes.