So many different options: Shipping confirmation emails, IP addresses of connected accounts, GPS of frequent locations (i.e at nights when you're presumably sleeping), phone number for 2FA that can easily be reverse-lookup'd to PII databases, etc. etc.