[tscs37]

I see an incredible weakpoint: Your email account becomes your only defense, meaning the password on it must be strong and you still need to remember it. And you need 2FA.

Not that this is not the case already, email accounts are already important.

[timvdalen]

I think the most important point of this 'thought experiment' is that it reveals that email accounts are already your only defense.

Even if you use a different strong password for all sites, if a site offers a password forgot function your email account is still the weakest link.