I guess if the affected users are keeping their phone and TFA method you could target their phone numbers to try to intercept new codes, although that’s not doable at scale.

Having phone numbers associated to accounts out in public is pretty bad in general, though.