[skue]

So what happens when someone's email account is compromised?

Currently there's a fair chance that the victim can reset passwords and change contact info for their online services before the hacker bothers to do so. But this would be impossible if email were used as the sole form of authentication.

[andrewmccall]

The same thing that happens now. Malicious user can recover/reset their password.

I'd assume that if you used the email to login and since the article talks about also using cookies with expiry dates in the future the codes in emails would be single use.