It seems not much less secure than a system that lets you reset your password simply by clicking a link in an email (which is to say, most password-based system

It seems not much less secure than a system that lets you reset your password simply by clicking a link in an email (which is to say, most password-based systems on the web). Either way, once you have access to the email account, you can authenticate.