Attacker can’t sign in with victims email unless they have gained access to victims email account. No session gets created for the authorized user until they pr

Attacker can’t sign in with victims email unless they have gained access to victims email account. No session gets created for the authorized user until they provide a valid code and salt (within 3 tries and 5 min).