I suppose, but if I already entered the code from my authenticator app is having me click on an email going to make it more secure? If they have my authenticator app then they've already totally owned me anyway.
Sending an email as a notification would serve the same purpose.
Sending an email as a notification would serve the same purpose.