[e4m]

Brute force it. 5 chars... all numeric. There can only be 100,000 possibilities. Of course, they may have logon limits to prevent this. 10^5

[dkokelley]

The phone call you receive will give you a three-digit security code. Enter the code, and you'll be logged into your email account immediately.

3 chars. There are only 1,000 ~ 250,000 combinations depending on if they are alphanumeric or not, and if they are case sensitive.

They should make the key expire after about a minute (or 3 attempts) to slow brute forcing.