Good catch! This was indeed an issue with the way we implemented 2-factor auth. Although it would have been very difficult for an attacker to exploit this, it was definitely still worth fixing promptly. We have remedied this issue, so now OTP's are truly one-time use. I've also comped your account with another quarter-BTC bonus. Keep the bug reports coming!