...
I totally agreed that email is not a private key, but only a 2-FA. I don't understand why they are not using Google Auth for withdrawing as an alternative. They only use it for login and for nothing else ...
i just found out about a new feature: now it is possible to use 2-FA for withdraw

that's a great! no more dealing with lost emails

thank you liqui