Unlike with passwords, where the attacker has to go to the extra step of clicking "I forgot my password" in order to convert access to the email inbox into access to all the user's services.