If you can access your email account with only the backup code and no password, Google is doing it wrong.