2FA user enumeration via password reset

Summary

While going live with additional 2FA options, a security researcher discovered that during password reset, users that had enabled 2FA were prompted for a second factor. This made the password reset more difficult, and could have allowed enumeration of users that had enabled 2FA. To some degree, 2FA enumeration was mitigated by existing rate-limiting. This also resolves #249467, which had the same root cause.