He's doing the password reset flow from his own device, and receives a link to the form containing the session id and his device id. He doesn't need to brutefor

He's doing the password reset flow from his own device, and receives a link to the form containing the session id and his device id. He doesn't need to bruteforce those. Instagram had a limit on the number of times that the user could guess the code, but they had a race condition that let the limit be bypassed. The fix is for them to fix the race condition.