I just tried it with an old account. It correctly gave out the first two letters of existing password

Luckily, 2FA was already enabled.