In a proper authentication system you'd still have to provide the 2nd factor after resetting your password. Resetting OTP should require recovery codes that you got when you set it up.