Think through what 'reset password' means. An attacker who accesses your email can reset your bank password. Your investment account. Your Venmo. Your Apple ID. Your Amazon — with your saved credit card and your home address. Your entire digital life is one email account away.
This means your email account deserves a level of protection nothing else does. Give it a unique password you use nowhere else. A long one — 16+ characters, or a passphrase. Something you've never typed anywhere else ever.
Then lock it down with the strongest 2FA available. Use an authenticator app, not SMS. If Gmail, enable Google's Advanced Protection Program. If you're a high-value target — journalist, activist, exec — this is non-negotiable.
Also: check what email address is connected to your most sensitive accounts. A lot of people have old addresses — Hotmail from 2003, a defunct work account — set as recovery emails. Those addresses may not even exist anymore. An attacker can sometimes register an abandoned email address.
The hierarchy of protection: email first, then bank, then everything else. If just these two accounts are secure, you've eliminated the most common attack path.