Existing thumbprint and retina identification have already been duped. Any system based providing an unchanging id of some kind can be.

And if someone is in my email account then they can reset all of my passwords anyway, by simply going to ILoveSheep.com and saying "Request password reset".