Username and passwords should be considered a single factor, even moreso for email since your username is often your email address and could be considered publi

Username and passwords should be considered a single factor, even moreso for email since your username is often your email address and could be considered public information. The four types of factors are: something you know, something you have, something you are, somewhere you are.