It might be an email security product which scans links in emails before forwarding onto the users inbox. This does sometimes cause havoc with email based OTP login flows.