Part of the problem is setting up a login system relying on a complicated network of unreliable mail providers (or SMS or any other poison du jour) in the critical path. That's asking for trouble even when everything on your end is done correctly and going smoothly.