Users being asked to authenticate via email with login security disabled

I just installed the application and have not turned on the recommended option to require two-factor authentication of administrators or editors as I need other users first to set up two-factor authentication. However, despite this, a user (who has the permissions of an editor) reported that when logging in, WordPress told her to get a code from an email account associated with the website (which is my email, but I didn’t get the email). Deactivating the plugin fixed this issue, but I don’t see any options which seem to affect her ability to log in other than the option that I didn’t enable.