At least in my case, the number/email they were willing to send a one-time passcode to were the ones I gave to my employer, not the ones I had entered earlier in the form.
So either the site is broken and leaking information, or someone has already laid claim to my access.