If a user has 2FA enabled, and someone finds out what their password is and tries to log into their account, they will be stopped at the 2FA step. This means a "successful" login happened from an unknown device, but thanks to 2FA the user was not let in completely.

If I understand the code of LoginNotify correctly, in a situation like this the victim account will *not* be notified because notifications depend on the AuthManagerLoginAuthenticateAudit hook, which is only triggered *after* the 2FA is done. If so, then we might want to use a different hook that would allow notification before 2FA check.