I faced the same issue and lost around 10k USD in cryptocurrencies because of that. I used to rely on evernote since a long time and I always thought that based on my recent activity, if someone tries to access my account from another country they will always ask to verify via email even without 2FA like Google or other websites do. but I just received an alert email at 4 am that my account was accessed from Cyprus (which is quite far from where I live and have never been there) and by 4:30 am all my cryptocurrencies were stolen because it had the password to my ethereum wallet. Such a poor security measure by such an important service. Never relying on Evernote again.