Report Showing a Request for a Sign-in Code

We have 2 factor authentication for unknown devices enabled for all users including Admin.  We have set the admin email address to an internal email.  This was set up over a year ago.  Today, we received an email for a sign-in code for the admin account.  We don’t know who would have requested it.  Is there a report that would help me investigate?  The person trying to login would not have received the sign in code email, so Access History would not show an entry.