This doesn't work for creation because it's too easy to spoof where the email came from. In the OP's diagram this really hinges on the Mail Transfer Agent (MTA

This doesn't work for creation because it's too easy to spoof where the email came from. In the OP's diagram this really hinges on the Mail Transfer Agent (MTA) needs the ability to verify that Mail User Agent (MUA) is legit, and that is quite hard. Realistically MTA would need to go to a known MUA address to verify do you actually own this account? But not all is lost! This does work great for 2FA. Where the contents itself is is the only requirement of trust. Just make the contents unrealistic to copy/spoof and then it doesn't matter who sent it.