The Register favicon

Thought two-factor auth completely locks down Office 365? Not quite