If she is still logged in somewhere, on a laptop, desktop, phone, whatever, then she can go and remove 2FA (no, you don't need the 2FA code to remove 2FA - or at least you didn't ~1 month ago).