Password and authenticator code are both required.
Ten attempts an hour from any one address. There is no password reset — the credential lives in the server's environment file.