I'd carefully consider using email for this. If you're hosting the service, you might need to use one of the bigger email providers that already have reputation (unless you already have good IPs with good rep). Otherwise, you risk the emails sitting in spam and people's switches being flipped. If it is self-hosted, you'll probably need to explain the risks to users.

Given today's world of pocket computers, you might consider using push notifications of some kind. Or have a companion client that pokes an API and there is some kind of challenge/response.