In addition to the recovery code as an alternative 2FA method, allow for sending an OTP to the user's email address.