Back in the day, before cryptocurrency was worth anything, an email address and a password was all you needed to login to an exchange. Then start requiring 2FA (two-factor authentication), using email