Assuming: * A hacker has a leaked database * Your email and password are in this database * Your public email is the same one used in the database * Plain-t

Assuming: * A hacker has a leaked database * Your email and password are in this database * Your public email is the same one used in the database * Plain-text passwords are easy to extract from this leaked databases * You use the same password and email combination other places * Other places with that email/password don't use two-step authentication Then if they have your email they can get your password and try it other places