He might not want 2fa because it lowers conversion rate. Less people would use the forum and the forum's only strength is its community. BUT the forum would be still big enough after 2fa. It's a classic in the scene, so ppl will continue to use it. I would use it with 2fa 
He doesn't need to make 2fa mandatory, just an option.
Received my first spam email last night. 
Welcome to hotmail, where spam emails are the only emails