Not sure it matters a ton if it is or not. Think about how many accounts you have that allow password reset via email. What's even higher value that they'd look to get to from email?

I imagine access to your emails is what you would want anyway—these days it’s the strongest proof you have, stronger than ssn.

No, it is.