But what about the MITM attacks that would happen until the admin checks his email and realises that an attack is happening? Wouldn't all attempted logins till then mean a severely compromised system?

Also, how do you decide whom to send the email to, especially in the shared hosting scenarios?

Instead of considering the issue as 'penalizing the client', shouldn't it be considered as who to would lose most in case of an attack and work on this entity's behalf and guard against this?