Whoever thought it would be a good idea to use email as a second factor should be punished.
Whoever thought it would be a good idea to use email as a second factor should be punished. And whoever thought it would be a good idea to use email as a second factor and let the code be only valid for five minutes should be punished even more.