[redwards510]

I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.

[chrisfosterelli]

Sorry, you're right that 2FA accounts will not receive the email. I've updated my comment.

In addition to the TOR IP block, you can also restrict it to only allow access from select countries. This is what I meant by geographic restriction.