Most services don't do that. I have had my personal email account DDoSed before and requiring access to that inbox to change my email address would have been impossible for over a month.