You chose to reuse the password and not enable 2FA. That's "fine" if you don't care about the account, however if you _really_ didn't care about the account you

You chose to reuse the password and not enable 2FA. That's "fine" if you don't care about the account, however if you _really_ didn't care about the account you wouldn't be posting this, correct? > Come on guys, I'd have to use my security email from before the time I was hacked, not the current one! This comes back to the question of how to differentiate between legitimate and illegitimate use. What if your recovery email address was compromised and you changed it, should it still be possible to use the old compromised recovery email address for recovery? > Google, a company that makes self driving cars, seems to use zero AI to detect fraudulent behavior? Google seems to ask me for my 2FA whenever my login seems odd (another place, another computer, ...) and emails me about the new sign-in just as it did for you. What would you want them to do when they detect fraudulent behaviour? If Google were to use AI to somehow block user sign-ins their support, if it exists, would be flooded due to edge cases.