RFC 4226 was defined way before google formed the idiom of "two step verification". Two step verification does not necessarily has to do anything with HOTP or TOTP. Of course you can use HOTP to create "non-guessable" codes, but it is not necessary.
Your service could simply remember which code was sent to the user.
In any case you should:
- create a code for each login attempt and
- the code (even with HOTP) should only be valid for a certain time.
The implementation in privacyidea does it this way. It can send codes via text message or email to the user. These codes are calculated based on HOTP. But the codes are only valid for a certain amount of time.
And the code is only valid for this very login session.
The question is, if the code residing in the smartphone or the email account is probably though to be more vulnerable. A dedicated attacker probably would not care if the code is on the mobile phone for 30 seconds or for 30 hours. But ask yourself. I would feel uncomfortable carrying around my smartphone, knowing that there is a code in it, that still can be used to login to any of my accounts. Sometimes the smartphone is not locked, or a malware could be installed just in this time - after receiving the code and before using the code. There are additional attack vectors. So you should invalidate the code after a few minutes.