Consecutive failures on an account since last success should be a red flag.

Increasing lockout time for attempts from devices new to that user might have value.

If the user is consistently being rejected at the 2nd factor then you can presume that the password has been compromised and reach out to the user.

In any case, pay attention to consecutive failures.