Booking.com ignores twofactor, lets everyone email-login without a password 2 years ago
Having the same problem. It's really annoying, and they don't seem interested in solving it.
[ my public key: https://keybase.io/sc250024; my proof: https://keybase.io/sc250024/sigs/FGmgCgxDom4sDl-aRB8E8pO_gKoUGO3TSR2L8gS5eRY ]