Most websites use email as the password recovery mechanism. "Authenticate by email" is strictly better than "authenticate by password or email".