[shader]

I'm guessing that as many people as are probably trying to log into his account, he probably doesn't answer his phone any more, or even use that email account. How would he know if the access he just authorized was him, or someone else?

Maybe if they texted him a code he had to type in, it would be more secure, but then it would be simple enough to brute force all of the codes, or find the seed and generation mechanism.