[weird-eye-issue]

You've never done a password reset? That goes to your email. If your 2FA is over email too then that isn't 2FA. Because you only need the email to take over an entire account

[rkeene2]

So I see the problem now, your model includes a hidden assumption that password resets go to email -- this is not always the case.