Because target WAS trying to login to BAD. Imagine a "free porn, login here" website, when you put in your gmail address it triggers the onetime code from gmai

Because target WAS trying to login to BAD. Imagine a "free porn, login here" website, when you put in your gmail address it triggers the onetime code from gmail (assuming it did that type of login) - thousands would give it up for the free porn.