What is the minimum number of things you need access to in order to log in?

If you have access to the phone, you can log in. OR if you have access to the email account, you can log in.

You don't need to know the user's password, you only need access to one of these inboxes and nothing else. One-factor authentication, but worse, because there are multiple attack surfaces.