Thanks to you all for taking the time as these are helpful responses.
So, it looks like 2FA is always a good idea, and if all goes south at least I have SSH access. Makes sense.
Also,
You are absolutely correct. I did set up an Admin and I was posting from that, not from system. My mistake.
Does anyone know if you can change a setting to NOT allow username logins (ie. and require email)?
Thanks again.