@elvissun Just literally wrote a LinkedIn post on this. We hit the same issue last week.
Didn't went full OTP though as Magic link happy path still works for a fair share of the users.
Mail now contains magic links and fallback OTP to use in case ML token has been consumed already.