Because in the context of signing in, its role is that of a user ID.

Ticketmaster spams that address constantly. It's a valid email address, to be sure, but they've trained me over the years never to look at it. They certainly didn't do any multi-factor authentication when I bought the tickets, only when I was preparing to use them (despite having accessed them on that very device two days earlier).