Most existing accounts allow password resets via email, so email compromise would also result in account compromise.