1 article on this topic.
Email is the recovery path for everything else. An attacker with it does not need your passwords.