If your password is leaked, and you then authorize the verification email by clicking on the verify text, how else do you expect Booking.com to prevent access? The point of 2-factor is lost if you are careless with your second factor.

[People seem to be downvoting me but no one seems to be replying with what the reasonable behavior should be. Maybe my understanding of 2FA through email verification is lacking?]