No, Google has implemented it (remember me) in a highly secure way. When you sign in with the checkbox ticked on, Google stores a unique hash in your browser cookie set. The hash is a combination of the your user name and password, but since it's a hash, no one can find out the original keys which resulted in hash. I.e., there's no way to reverse the hash.

Now every time you get to one of Google's web pages, it checks for this cookie and verifies it to be matching on the server side. If it matches, you're signed in automatically.

Now to the spoofing part, if you spoof your IP and MAC (which is easier said than done, believe me), he doesn't still have the cookie or the session active at his end. However, when I think again, it is remotely possible (read as almost impossible unless you have a real good hacker in your local network) to watch your conversation with the server for a long time, get hold of your cookies and then do a man in the middle attack.

Easiest way for you is to secure your communication via SSL. Turn it on in the preferences of Gmail, and that's it. No more man in the middle attack and nothing can be done by spoofing IP.