Hmmmmmm. If I get a spurious Twitter 2fa code, that means they already had my password, right?
When I tried in an anonymous window just now, putting in a wrong password doesn't get me to the 2fa.
When I tried in an anonymous window just now, putting in a wrong password doesn't get me to the 2fa.