[Shoothe]

You are only giving the site your JID (username) not password and it verifies that you control the JID so you really are [e-mail]

[Zash]

Indeed, it should be comparable to authentication by token or link sent via email.