It should use 2fa and another email. For corporate just internal IT right? Security here seems lapse. Ideally reports are links to an internal system not attachments.