[nathankleyn]

This is true only if you use SMS for 2FA.

For either method, you can audit the activity of your account on the GitHub security page: https://github.com/settings/security. For example, upon having deliberately got my 2FA token wrong, "user.two_factor_requested" and "user.failed_login" events were logged for me.

[eric_h]

Interesting, I'd never checked that log before, and I just noticed a failed login (though no two_factor_requested) from an IP address in Brazil.

I'm gonna change my password just in case.