In my previous job, which was security-related, we had to deal with people forgetting their 2FA credentials (and many, many people forgot their credentials, even staff members). The way we did it was thus:
If you had enabled 2FA, it could be disabled/reset by calling support and adequately proving you were the owner of the account. This had to be this way, because, as I said, everyone forgot their 2FA credentials ("my phone fell in the sea and the backup codes were on it").
We also had another checkbox that said "Never, under any circumstances, reset my account. I have stored my backup codes somewhere secure that is not my phone. I understand that, if I lose access, I lose the account."
If the user checked that, then the password/2FA reset system for the admins got disabled for their account. If they lost their 2FA, nobody short of DBAs could reset their account (and DBAs knew not to).
Additionally, we had a screen where you could print a long, random, one-use key that would reset your account. It would come with a nice QR code so you could physically print it on a piece of paper and store it somewhere, and scan it if you ever forgot your 2FA/password, and it would let you access your account.
or
b) use the "forgot my password" option every time
reply