[adrr]

Six digit code means they can brute force it if they try across enough accounts. 500k tries they'll have 50% success rate of brute forcing 1 account.

[quickthrower2]

Nitpick: Less than 50% chance, but with a chance of finding more than 1.