There's a finite probability of landing on the combination of login+password+2FA-string at any given instance.