With free e-mail, the more accesses there are, the more money they potentially make from advertising sales, so they don't put that much thought into the design of the system for security.