The problem is that since they know your email address, they can find your email from leaked databases... Then try that password to own your repo...

what password?

Assuming:

* A hacker has a leaked database

* Your email and password are in this database

* Your public email is the same one used in the database

* Plain-text passwords are easy to extract from this leaked databases

* You use the same password and email combination other places

* Other places with that email/password don't use two-step authentication

Then if they have your email they can get your password and try it other places

> You use the same password and email combination other places

This is the problem. Every password for every account you create should be unique. Bonus points if you use a unique email alias for every account you create too.

That one single password you use on all webpages, clearly.