Phone number is a primary second factor for most people, and either a phone number or an email address is required to authenticate the person logging in is real

Phone number is a primary second factor for most people, and either a phone number or an email address is required to authenticate the person logging in is really the owner of the account in many instances such as logging in from a different computer. Google does the same, they've even published a paper showing just adding an email address is enough to eliminate 90+% of phishing attempts.