3 ms·

I just tried it with an old account. It correctly gave out the first two letters of existing password Luckily, 2FA was already enabled.