One could even set up an auto-responder email that returns TOTP code: if you include your own password in an incoming email, it returns a new TOTP code. If you

One could even set up an auto-responder email that returns TOTP code: if you include your own password in an incoming email, it returns a new TOTP code. If you properly set up your mail client and server, it should also be TLS encrypted, so no MITM attack vector either.