REPORTING SYSTEM X requires two-factor authentication; not a terrible idea in principle if you want to stop unknown people logging in to submit data for fun.

TFA achievable by using Google Authenticator w/out logging in, and submitting the code GA gives you. So in fact not authenticating anything.