How odd, it's not mentioned in the documentation. I'll ask an admin.
Afaik that is used for people not using 2fa. So they might be asked for email confirmation when changing hotspots or vpn.
It leads to the paradox situation that in some instances non 2fa accounts are more secure than 2fa accounts, because of cookie theft.
It's mentioned in the documentation here: https://itch.io/docs/advanced/two-factor-authentication
