My own live bookings seem unaffected (no weird email changes), and I just managed to successfully check in (via the app) for a flight tomorrow to the UK. Two-factor authentication is indeed now in use to manage bookings/check in (at least via the app), through a code sent via email.