I’ve thought about this method. I think this is what should be done for sites where you log in very infrequent (say, yearly). Do you know of any examples where this is implemented?
About the frequency: there aren't many situations where a user has access to your application, but not to email. I've been thinking about that, but when you have access to a browser, (most of the times) you have access to your mail.