I'm going to go ahead and say that he used an email service which does not offer 2FA since every email service that does support 2FA probably has a good brute f

I'm going to go ahead and say that he used an email service which does not offer 2FA since every email service that does support 2FA probably has a good brute force protection.