Phone number is a primary second factor for most people, and either a phone number or an email address is required to authenticate the person logging in is really the owner of the account in many instances such as logging in from a different computer.

Google does the same, they've even published a paper showing just adding an email address is enough to eliminate 90+% of phishing attempts.