If a hacker has your email address, he has half of your confidential information – all that's remaining is your password. And they can gain that by sending you a phishing email saying that your account has been accessed from a new device or compromised.