He might be using two different password manager accounts, one for passwords and one TOTP? Although it doesn't help much if he logs in from the same machine anyway.