If you're using Gmail for smtp (on a personal Gmail they may apply limits), the most reliable strategy is to set up an app password. For this, you'll need to turn on 2fa, which will allow the 'app passwords' menu to show up. Generate one for Flarum, and put that instead of your account password in the flarum email config