I don't think there is a simple answer for this: your security demands may vary. If you fear keyloggers stealing your passwords, giving adversaries access to confidential email, then by all means use 2-factor authorization (among other techniques). However, if you only anticipate receiving relatively mundane emails then there isn't a need for it, and enabling it could be an extra burden -- e.g., if you lose your cell phone on vacation you can't log in to any of your systems.
Additionally, using 2-factor auth may encourage bad habits; e.g., you may think my phone is always on me; so I can use a simple easily guessable password. Then on systems that have been authenticated once, it may be straightforward for someone to guess your password.
In summary; 2-factor auth provides extra security when:
- users frequently authenticate from a variety of untrusted client computers that may be running keyloggers
- users don't mind the burden of needing to be able to receive text message/phone call to authenticate
- users don't always cache the first authentication (only cache on trusted computers; and still require the user to enter password)
- users are still required to have strong passwords in the second authentication
- web authentication still use https (or equivalent; e.g., ssh login) (prevent MITM attacks with spoofed servers; keep your password secret in case a valid token is later found).
As an aside, email by itself is not a good method for sending confidential data -- the email as its routed is sent in plaintext for any intermediate mail server/router/transport agent to read. You really should encrypt/sign sensitive emails using PGP (or similar) to protect the contents of emails from being read or secretly altered.