Sends code without valid user

Hi, thanks for the plugin.

Currently the plugin sends a code on every login attempt with a valid username, the password does not have to be valid. I think this is a problem. The plugin should only send a code if the login is valid, otherwise too many codes are sent, which unsettles the users. Can the plugin be adapted accordingly?

Thanks a lot