Sure, but then you just log into your email and click a link and then you are in. Lots of sites do this and it would prevent this kind of attack in most cases. (assuming the leaked password was not also reused in email, but then you are in for an entirely different level of hurt anyways)