Two-factor authentication (2FA)
A second login credential beyond the password — a code from an app, a hardware key, or (weakest) an SMS.
SMS codes are defeated by SIM swaps and authenticator codes by real-time phishing; hardware security keys resist both because they only respond to the genuine domain. Secure the email account that can reset the exchange password at least as strongly as the exchange itself.