[kinofcain]

As ams6110 noted, it's likely not a 2-factor auth attack but rather a password reset attack.