1) Probably all of them, but I couldn’t test every account. Mainly authenticator ones, but one e-mail authentication as well.
2) On one website it started appearing after trying to use one invalid code (it made it impossible to login with a valid one), but on the other site I don’t think that someone used invalid code.
Issue persists even after I restarted my server.