Two-factor authentication is required. This account can email the entire customer base; a password on its own is not enough to stand in front of that.