Also systems should always notify users if their password or email address has been changed, immediately alerting that they've been compromised.

2factor authentication is great so you always know if someone is attempting to login as you.