Is it? Obviously it gets sent to the mail server, but that's usually TLS encrypted. Worth checking if it uses STARTTLS, but not that bad.

> Let's call it 0FA.

No, still 1 factor.