Yes, extra points of failure may include:

- Having webmail which is not protected with two factor authentication

- Enabling POP/IMAP which also does not have two factor authentication