Comment by philfreo

Can someone explain point #9 in the gist? How’d they know part of the two factor code?