Thanks for the insight about email addresses, I hadn't considered that. I know from personal experience that I usually get new addresses but rarely abandon old ones.
I wonder if providing the option to use a phone number OR an email address to receive the code be a good fail safe?