It is an extra layer of security...take your pick on which one you want: name/password/IP address or name/password/one-time-use-password. One is considerably harder to spoof than the other. Otherwise, all they need is your user/password to log in right away and steal your stuff as soon as you log out. This at least slows them down a bit, forcing them to be a bit more selective on their targets I guess.

Should probably seriously consider one of the tokens or set up the free smartphone app. You will be far better secured and no longer have to deal with the hassle anymore. As an added bonus you get a free teleport option you can assign to any crystal in the game and port to it as often as your teleport cooldown allows.