I don't use LastPass.com, but from the perspective of two factor authentication, you are entirely correct in your claim that allowing this to be disabled by the registered e-mail address makes the...