[9Ljdg6p8ZSzejt]

Username and passwords should be considered a single factor, even moreso for email since your username is often your email address and could be considered public information.

The four types of factors are: something you know, something you have, something you are, somewhere you are.