You can adjust this by simply requiring user to type a code from their email.

That said, if an attacker had persistent access to your email, you’d still be compromised through this method.