Firstly that alerts the person to the breach, because you have to change their password - which isn't true of a session hijack.

Secondly how are you getting the mail? I haven't been able to access my able without SSL for years and I lock my screen everytime I leave it + never leave my phone hanging around.

Thirdly would you even know the email address I used? I use a different one for each site.