In fact, two is enough. Try putting an electrode to each hand. Yet, some ECG input stages have almost literally infinite input resistance. So just two electrodes may (and actually do) float away out of the input range. So here comes the third electrode, that puts the whole body potential somewhere near the 0V of the input.