The email must be able to be used at any time which means that and attacker may be able to also "use" them.