@dansup i guess ultimately, anyone with access to the account's associated email has power out of your hands anyway, so 1 or just same-email requirement may be fine.