This is most likely "Working as designed" but in the case the design is questionable 
TFA is meant to protect the account (and sensitive data within it), but unfortunately emai TFA display the following message when triggered:
In case of an unauthorized access to the account (by an attacker that only has username and password) this leaks the users email address - effectively...
Read more
Continue reading...
TFA is meant to protect the account (and sensitive data within it), but unfortunately emai TFA display the following message when triggered:
In case of an unauthorized access to the account (by an attacker that only has username and password) this leaks the users email address - effectively...
Read more
Continue reading...