So apart from the 4 pretty much "how not to happen", try using a host that supports 2FA.
I've been using Hover a lot, but I'm not sure what their exposure is like.
edit Can only receive the text code on US-based numbers, but you can get one of those from something like Google Voice for free.