User cannot log in with 2-factor auth. Says "each code can only be used once"

The user was connected with 2-factor auth before. Suddenly he was denied login (after connecting from another device). Trying to solve this i as admin deleted his old account (it was new, no replies yet so we didn’t mind), but the problem repeats when he tried to create a new account:


the user deleted the account from his google authenticator app, and re-scanned the new QR code. that didn’t help.
what “code” is being used again?

Discourse version: 9da9b2e1

Looking for clues for this error message: