Can someone explain how this was possible

It was possible due to a lack of rate-limiting on the action/request. As you said, it could be brute-forced hence.

Instagram has now patched this issue. I haven't seen any official publication on the mitigation measures, but a quick visit to [Instagram's Password Reset Page][1] reveals the [intended] user is now sent a link.

and how to mitigate it?

You could rate-limit the action/request - not only by IP address but actually upon the action itself. However, this would pose a potential DOS(Denial of Service) attack - hence why Instagram probably did not limit it as such in the first place. For one, given it is a 6 digit code given to the user you could significantly reduce the rate-limiting threshold per IP address (i.e. from 200 to 20) to increase significantly the cost of the attack.

But put simply, the 6 digit code itself is flawed. Although the DOS attack may be viewed as 'unlikely', it carries relatively small cost given the potential gains/motives for the attacker, so it should be mitigated. Hence, as instagram have - the easiest solution is to verify the user via more secure means, e.g.:

Send a link to the user (via external, previously established, communication channels) and then get them to input the code at this unique link.

Make the code 10 digits alphanumeric and set a 30 minute expiration & rate-limit the number of codes that can be issued repeatedly.

etc. [1]: https://www.instagram.com/accounts/password/reset/

Can someone explain how this was possible

It was possible due to a lack of rate-limiting on the action/request. As you said, it could be brute-forced hence.

Instagram has now patched this issue. I haven't seen any official publication on the mitigation measures, but a quick visit to Instagram's Password Reset Page reveals the [intended] user is now sent a link.

and how to mitigate it?

You could rate-limit the action/request - not only by IP address but actually upon the action itself. However, this would pose a potential DOS(Denial of Service) attack - hence why Instagram probably did not limit it as such in the first place. For one, given it is a 6 digit code given to the user you could significantly reduce the rate-limiting threshold per IP address (i.e. from 200 to 20) to increase significantly the cost of the attack.

But put simply, the 6 digit code itself is flawed. Although the DOS attack may be viewed as 'unlikely', it carries relatively small cost given the potential gains/motives for the attacker, so it should be mitigated. Hence, as instagram have - the easiest solution is to verify the user via more secure means, e.g.:

Send a link to the user (via external, previously established, communication channels) and then get them to input the code at this unique link.

Make the code 10 digits alphanumeric and set a 30 minute expiration & rate-limit the number of codes that can be issued repeatedly.

etc.