I'm mostly playing devil's advocate, but there could definitely be a process around that 2FA token that isn't there for a password reset.

Verifying the employee's mailing address vs just replying to them over the phone or email sounds like a hurdle. Might not be the same person shipping out the token, so now you have to prove it to two people. Blockers like that.